-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple Vulnerabilities in Microsoft ASN.1 Library
Original issue date: February 10, 2004
Last revised: --
Source: US-CERT
A complete revision history is at the end of this document.
Systems Affected
* Microsoft Windows NT 4.0
* Microsoft Windows NT 4.0 TSE
* Microsoft Windows 2000
* Microsoft Windows XP
* Microsoft Windows Server 2003
Overview
Multiple integer overflow vulnerabilities in the Microsoft Windows
ASN.1 parser library could allow an unauthenticated, remote attacker
to execute arbitrary code with SYSTEM privileges.
Description
Microsoft Security Bulletin MS04-007 announces a patch for multiple
vulnerabilities in the Microsoft Windows ASN.1 library
(msasn1.dll). According to information from eEye Digital Security,
the vulnerabilities involve integer overflows and other flaws in
integer arithmetic. The latest version of this document can be
found at
<http://www.us-cert.gov/cas/techalerts/TA04-041A.html>
Additional information is available in two vulnerability notes:
VU#216324 - Microsoft ASN.1 Library improperly decodes malformed ASN.1
length values
(Other resources: AD20040210, MS04-007, CAN-2003-0818)
VU#583108 - Microsoft ASN.1 Library improperly decodes constructed bit
strings
(Other resources: AD20040210-2, MS04-007, CAN-2003-0818)
eEye has published two detailed advisories on these issues: AD20040210
and AD20040210-2.
Any application that loads the ASN.1 library could serve as an attack
vector. In particular, ASN.1 is used by a number of cryptographic and
authentication services such as digital certificates (x.509),
Kerberos, NTLMv2, SSL,and TLS. Both client and server systems are
affected. The Local Security Authority Subsystem (lsass.exe) and a
component of the CryptoAPI (crypt32.dll) use the vulnerable ASN.1
library.
Impact
An unauthenticated, remote attacker could execute arbitrary code with
the privileges of the process using the ASN.1 library. In the case of
most server and authentication applications, an attacker could gain
SYSTEM privileges.
Solution
Apply a patch
Apply the appropriate patch as specified by Microsoft Security
Bulletin MS04-007.
Vendor Information
This appendix contains information provided by vendors. When vendors
report new information, this section is updated and the changes are
noted in the revision history. If a vendor is not listed below, we
have not received their comments.
Microsoft
Please see Microsoft Security Bulletin MS04-007.
References
* Vulnerability Note VU#216324 -
<http://www.kb.cert.org/vuls/id/216324>
* Vulnerability Note VU#583108 -
<http://www.kb.cert.org/vuls/id/583108>
* eEye Digital Security Advisory AD20040210 -
<http://www.eeye.com/html/Research/Advisories/AD20040210.html>
* eEye Digital Security Advisory AD20040210-2 -
<http://www.eeye.com/html/Research/Advisories/AD20040210-2.html>
* Microsoft Security Bulletin MS04-007 -
<http://microsoft.com/technet/security/bulletin/MS04-007.asp>
* Microsoft Knowledge Base Article 252648 -
<http://support.microsoft.com/default.aspx?scid=252648>
_________________________________________________________________
These vulnerabilities were researched and reported by eEye Digital
Security. Information from eEye and Microsoft was used in this
document.
_________________________________________________________________
Feedback can be directed to the author, Art Manion.
Copyright 2004 Carnegie Mellon University.
Revision History
February 10, 2004: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFAKVrdXlvNRxAkFWARAuOvAJwL2gJJPBRdrtZ0Le4yyLQLu7CHewCgvaCW
5hU8LQ/oOC4sI8PpnkppCyg=
=Oe/N
-----END PGP SIGNATURE-----
