=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN201
_____________________________________________________________________

DATE                : 19/09/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Systems running SAP Crystal Reports.

======================================================================
http://www.zerodayinitiative.com/advisories/ZDI-14-302/
http://www.zerodayinitiative.com/advisories/ZDI-14-301/
______________________________________________________________________

SAP Crystal Reports Connection String Processing Double Free Remote Code
Execution Vulnerability

ZDI-14-302: September 3rd, 2014

CVE ID

    CVE-2014-5506

CVSS Score

    6.8, (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Affected Vendors

    SAP

Affected Products

    Crystal Reports


Vulnerability Details


This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of SAP Crystal Reports. User interaction is
required to exploit this vulnerability in that the target must visit a
malicious page or open a malicious file.

The specific flaw exists within the handling of RPT files. The issue
lies in processing a connection string record. An attacker can leverage
this vulnerability to execute code under the context of the current process.


Vendor Response

SAP has issued an update to correct this vulnerability. More details
can be found at:

    http://service.sap.com/sap/support/notes/1999142

Disclosure Timeline

    2014-03-07 - Vulnerability reported to vendor
    2014-09-03 - Coordinated public release of advisory

Credit
This vulnerability was discovered by:

    Aniway.Anyway@gmail.com

___________________________________________________________________

SAP Crystal Reports Datasource Stack Buffer Overflow Remote Code
Execution Vulnerability

ZDI-14-301: September 3rd, 2014


CVE ID

    CVE-2014-5505

CVSS Score

    6.8, (AV:N/AC:M/Au:N/C:P/I:P/A:P)


Affected Vendors

    SAP


Affected Products

    Crystal Reports


Vulnerability Details


This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of SAP Crystal Reports. User interaction is
required to exploit this vulnerability in that the target must visit a
malicious page or open a malicious file.

The specific flaw exists within the handling of RPT files. The issue
lies in the processing of data source strings. An attacker can leverage
this vulnerability to execute code under the context of the current
process.


Vendor Response

SAP has issued an update to correct this vulnerability. More details can
be found at:

    http://service.sap.com/sap/support/notes/1999142

Disclosure Timeline

    2014-03-07 - Vulnerability reported to vendor
    2014-09-03 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:

    Aniway.Anyway@gmail.com

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================