Test ID:	1.3.6.1.4.1.25623.1.0.801767
Category:	Buffer overflow
Title:	SAP Crystal Reports Print ActiveX Control Buffer Overflow Vulnerability
Summary:	SAP Crystal Reports is prone to heap-based buffer overflow vulnerability.
Description:	Summary: SAP Crystal Reports is prone to heap-based buffer overflow vulnerability. Vulnerability Insight: The flaw exists due to boundary error in the 'CrystalReports12.CrystalPrintControl.1' ActiveX control (PrintControl.dll) when processing 'ServerResourceVersion' which can be exploited to cause a heap-based buffer overflow via an overly long string. Vulnerability Impact: Successful exploitation will allow remote attackers to execute arbitrary code in the context of the application using the ActiveX control. Failed exploit attempts will likely result in denial-of-service condition. Affected Software/OS: Crystal Reports 2008 SP3 Fix Pack 3.2(12.3.2.753) Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-2590 BugTraq ID: 45387 http://www.securityfocus.com/bid/45387 Bugtraq: 20101220 Secunia Research: SAP Crystal Reports Print ActiveX Control Buffer Overflow (Google Search) http://www.securityfocus.com/archive/1/515369/100/0/threaded http://www.exploit-db.com/exploits/15733 http://pocoftheday.blogspot.com/2010/12/crystal-reports-viewer-1200549-activex.html http://secunia.com/secunia_research/2010-135/ https://service.sap.com/sap/support/notes/1539269 http://www.osvdb.org/69917 http://www.securitytracker.com/id?1024915 http://secunia.com/advisories/42305
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.