Cytel Studio <= 9.0 .CY3 File Stack Buffer Overflow
Vulnerability Description
Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer (256 bytes) without proper bounds checking. Exploitation allows arbitrary code execution when the crafted file is opened.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2011-10015
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Luigi Auriemma
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/cytel_studio_cy3.rb
- https://www.exploit-db.com/exploits/17930
- https://www.exploit-db.com/exploits/18027
- http://aluigi.altervista.org/adv/cytel_1-adv.txt
- https://web.archive.org/web/20110708215826/http://www.cytel.com/Software/LogXact.aspx
- https://web.archive.org/web/20110708215830/http://www.cytel.com/Software/StatXact.aspx
- https://web.archive.org/web/20110301000000*/http://www.cytel.com/Software/StatXact.aspx
- https://www.vulncheck.com/advisories/cytel-studio-cy3-file-stack-buffer-overflow
Affected Vendor
Cytel Inc.
View all reports →