----------------------------------------------------------------------

Do you need accurate and reliable IDS / IPS / AV detection rules?

Get in-depth vulnerability details:
http://secunia.com/binary_analysis/sample_analysis/

----------------------------------------------------------------------

TITLE:
Data Dynamics ActiveReports ARViewer2 ActiveX Control Insecure
Methods

SECUNIA ADVISORY ID:
SA31894

VERIFY ADVISORY:
http://secunia.com/advisories/31894/

CRITICAL:
Highly critical

IMPACT:
Manipulation of data, System access

WHERE:
>From remote

SOFTWARE:
Data Dynamics ActiveReports 2.x
http://secunia.com/advisories/product/14851/

DESCRIPTION:
Tan Chew Keong has reported some vulnerabilities in Data Dynamics
ActiveReports, which can be exploited by malicious people to
overwrite arbitrary files and compromise a user's system.

The vulnerabilities are caused due to the
DDActiveReportsViewer2.ARViewer2 (ARVIEW2.OCX) ActiveX control
including the insecure methods "Pages.Save()", "PrintReport()", and
"Canvas.Save()", which write to a file specified as an argument. This
can be exploited to overwrite and corrupt arbitrary files on the
system in the context of the currently logged-on user. The
"Canvas.Save()" method further allows writing user specified data
into arbitrary files.

Successful exploitation requires that a user is e.g. tricked into
visiting a malicious website.

The vulnerabilities are reported in Data Dynamics ActiveReport
Professional Edition Build 2.5.0.1314 (ARView2.ocx version
2.5.0.1314). Other versions may also be affected.

SOLUTION:
Set the kill-bit for the affected ActiveX control.

PROVIDED AND/OR DISCOVERED BY:
Tan Chew Keong, vuln.sg

ORIGINAL ADVISORY:
http://vuln.sg/ddarviewer2501314-en.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------