Secunia

Tan Chew Keong has reported some vulnerabilities in Data Dynamics ActiveReports, which can be exploited by malicious people to overwrite arbitrary files and compromise a user's system.

The vulnerabilities are caused due to the DDActiveReportsViewer2.ARViewer2 (ARVIEW2.OCX) ActiveX control including the insecure methods "Pages.Save()", "PrintReport()", and "Canvas.Save()", which write to a file specified as an argument. This can be exploited to overwrite and corrupt arbitrary files on the system in the context of the currently logged-on user. The "Canvas.Save()" method further allows writing user specified data into arbitrary files.

Successful exploitation requires that a user is e.g. tricked into visiting a malicious website.

The vulnerabilities are reported in Data Dynamics ActiveReport Professional Edition Build 2.5.0.1314 (ARView2.ocx version 2.5.0.1314). Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
Tan Chew Keong, vuln.sg

Changelog
Further details available in Customer Area

Original Advisory
http://vuln.sg/ddarviewer2501314-en.html

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area