Buffer Overflow in QlikView FTP Input Causes DoS Crash

Executive Summary

This vulnerability is a denial of service (DoS) issue in QlikView version 12.50.20000.0. It occurs when a local attacker pastes a specially crafted 300-character buffer into the FTP server address input field. This causes the application to crash, preventing it from functioning normally. The problem arises due to improper input handling in the FTP Server Address field. [1]

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker with local access can cause the QlikView application to crash by pasting a crafted input into the FTP server address field. This results in a denial of service, disrupting normal application functionality and potentially halting business processes that rely on QlikView. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to reproduce the denial of service condition locally. Specifically, you can run a script to generate a 300-character buffer (e.g., a string of 300 'A's), copy it to the clipboard, and then paste it into the 'FTP Server Address' field in QlikView's 'Open FTP ...' dialog. If the application crashes upon pasting and attempting to connect, the vulnerability is present. The proof-of-concept involves using a Python script to create the buffer file and then manually pasting it into the application. There are no specific network commands since this is a local input vulnerability. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding pasting or entering excessively long input (such as 300-character buffers) into the FTP Server Address field in QlikView. Restrict user access to the application to trusted users only, and monitor for any crashes related to this input field. Since this is a local denial of service vulnerability, applying any available patches or updates from QlikView when released is recommended. Until a patch is available, user education and input validation controls are the best immediate measures. [1]

Useful 0 Not Useful 0