Description
Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer (256 bytes) without proper bounds checking. Exploitation allows arbitrary code execution when the crafted file is opened.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Cytel Inc. Cytel Studio
Default version status: unaffected
0 to ≤ 9.0affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/cytel_studio_cy3.rb ↗
- https://www.exploit-db.com/exploits/17930 ↗
- https://www.exploit-db.com/exploits/18027 ↗
- http://aluigi.altervista.org/adv/cytel_1-adv.txt ↗
- https://web.archive.org/web/20110708215826/http://www.cytel.com/Software/LogXact.aspx ↗
- https://web.archive.org/web/20110708215830/http://www.cytel.com/Software/StatXact.aspx ↗
- https://web.archive.org/web/20110301000000*/http://www.cytel.com/Software/StatXact.aspx ↗
- https://www.vulncheck.com/advisories/cytel-studio-cy3-file-stack-buffer-overflow ↗