Race Condition in Crystal Reports XI Release 2 Affecting Enterprise Tree ActiveX Control
CVE-2008-0379

Currently unrated

Key Information:

Vendor

Microsoft
Status
Activex
Crystal Reports Xi
Vendor
CVE Published:
22 January 2008

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 13%

What is CVE-2008-0379?

A race condition vulnerability exists in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) within Crystal Reports XI Release 2. This flaw allows remote attackers to trigger a denial of service by exploiting the SelectedSession method, leading to a system crash. In addition, the vulnerability could potentially enable the execution of arbitrary code through a buffer overflow, posing a significant risk to the integrity and availability of systems utilizing this software.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2008-0379 - Proof of Concept

References

https://www.exploit-db.com/exploits/4931
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/27333
vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1019239
vdb-entryx_refsource_SECTRACK

EPSS Score

13% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.