=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2010/VULN410
_____________________________________________________________________

DATE                      : 14/10/2010

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running SAP Crystal Reports.

======================================================================
http://www.zerodayinitiative.com/advisories/ZDI-10-196/
http://www.zerodayinitiative.com/advisories/ZDI-10-195/
______________________________________________________________________

SAP Crystal Reports JobServer GIOP Request Remote Code Execution Vulnerability

ZDI-10-196: October 12th, 2010

CVSS Score

      10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Affected Vendors

      SAP

Affected Products

      Crystal Reports

TippingPoint IPS Customer Protection TippingPoint IPS customers are protected
against this vulnerability by Digital Vaccine protection filter ID 10482. For
further product information on the TippingPoint IPS:

      http://www.tippingpoint.com

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of SAP Crystal Reports. Authentication is not
required to exploit this vulnerability.

The specific flaw exists within the JobServer.exe process which listens by
default on several TCP ports above 1024. When parsing a GIOP request, the
process trusts a user-supplied 32-bit value and allocates a buffer on the
heap. The process then proceeds to copy the string following this value from
the packet until it finds a NULL byte. By crafting a specifically sized packet
a remote attacker can overflow the buffer and gain code execution under the
context of the SYSTEM user. Vendor Response SAP states:

A solution was provided via SAP note 1509604
(https://websmp130.sap-ag.de/sap/support/notes/1509604)

Disclosure Timeline

      2010-07-20 - Vulnerability reported to vendor 2010-10-12 - Coordinated
                   public release of advisory

Credit This vulnerability was discovered by:

      AbdulAziz Hariri
__________________________________________________________________________

SAP BusinessObjects Crystal Reports Server CMS.exe Remote Code Execution
Vulnerability

ZDI-10-195: October 12th, 2010

CVSS Score

      10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Affected Vendors

      SAP

Affected Products

      Crystal Reports

TippingPoint IPS Customer Protection TippingPoint IPS customers are protected
against this vulnerability by Digital Vaccine protection filter ID 10482. For
further product information on the TippingPoint IPS:

      http://www.tippingpoint.com

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of SAP Crystal Reports. Authentication is not
required to exploit this vulnerability.

The specific flaw exists within the CMS.exe process which listens by default
on several TCP ports above 1024. When parsing a GIOP request, the process
trusts a user-supplied 32-bit value and allocates a buffer on the heap. The
process then proceeds to copy the string following this value from the packet
until it finds a NULL byte. By crafting a specifically sized packet a remote
attacker can overflow the buffer and gain code execution under the context of
the SYSTEM user. Vendor Response SAP states:

A solution was provided via SAP note 1509604
(https://websmp130.sap-ag.de/sap/support/notes/1509604)

Disclosure Timeline

      2010-07-20 - Vulnerability reported to vendor 2010-10-12 - Coordinated
                   public release of advisory

Credit This vulnerability was discovered by:

      AbdulAziz Hariri Andrea Micalizzi aka rgod

======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================