Description
Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer (256 bytes) without proper bounds checking. Exploitation allows arbitrary code execution when the crafted file is opened.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cytel | Cytel Studio | ≤ 9.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Cytel Studio 9.0 (CY3 File) Stack Buffer Overflow
exploit/windows/fileformat/cytel_studio_cy3
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/cytel_studio_cy3.rb exploit
- https://www.exploit-db.com/exploits/17930 exploit
- https://www.exploit-db.com/exploits/18027 exploit
- http://aluigi.altervista.org/adv/cytel_1-adv.txt technical-description exploit
- https://web.archive.org/web/20110708215826/http://www.cytel.com/Software/LogXact.aspx product
- https://web.archive.org/web/20110708215830/http://www.cytel.com/Software/StatXact.aspx product
- https://web.archive.org/web/20110301000000*/http://www.cytel.com/Software/StatXact.aspx product
- https://www.vulncheck.com/advisories/cytel-studio-cy3-file-stack-buffer-overflow third-party-advisory