cbcvebase.
CVE-2010-2590
published 2010-12-22

CVE-2010-2590: Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix…

PriorityP262critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
46.78%
98.7th percentile
Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute arbitrary code via a long ServerResourceVersion property value.

Affected

1 ranges
VendorProductVersion rangeFixed in
sapcrystal_reports

Detection & IOCsextracted from sources · hover to see the quote

other{88DD90B6-C770-4CFF-B7A4-3AFD16BB8824}
filenamePrintControl.dll
versionPrintControl.dll 12.3.2.753
commandServerResourceVersion
bytes
\x81\xc4\xa4\xf3\xfe\xff
  • Detect instantiation of the vulnerable ActiveX control by its CLSID {88DD90B6-C770-4CFF-B7A4-3AFD16BB8824} (CrystalReports12.CrystalPrintControl.1) in HTML/script content.
  • Alert on unusually long string assignments to the ServerResourceVersion property of the CrystalPrintControl ActiveX object; the exploit uses an offset of 0x5F4 (1524 bytes) to reach the return address.
  • Detect heap-spray patterns using the 0x0c0c0c0c / 0x0c0c0c08 marker values in JavaScript targeting IE 6–8 on Windows XP/7.
  • Detect ROP gadget addresses from msvcr71.dll (e.g., 0x7c342643, 0x7c37653d) in memory or network content; the exploit uses msvcr71.dll loaded by the ActiveX control to bypass DEP and ASLR.
  • Monitor for the stack-adjustment prepend encoder bytes \x81\xc4\xa4\xf3\xfe\xff (add esp, -500) in shellcode delivered via browser exploits.
  • Flag presence of PrintControl.dll version 12.3.2.753 (or 12.0.0.683 / 12.0.0.549) loaded in browser processes; these are the vulnerable versions.
  • ·The exploit only targets Internet Explorer versions 6, 7, and 8 on Windows XP SP3 and IE 8 on Windows 7 SP1; other browsers are not affected.
  • ·DEP/ASLR bypass relies on msvcr71.dll being loaded by the ActiveX control; environments without msvcr71.dll (e.g., newer JRE-less systems) may not be exploitable via the documented ROP chain.
  • ·The Metasploit module defaults to 'migrate -f' post-exploitation, meaning the initial process may change immediately after exploitation, affecting forensic artifacts.
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.