[NT] Microsoft ASN.1 Library Vulnerability Could Allow Code Execution (MS04-007)

From: SecuriTeam (support_at_securiteam.com)
Date: 02/11/04

Next message: SecuriTeam: "[NT] Vulnerability in the Windows Internet Naming Service (WINS) Could Allow Code Execution (MS04-006)"

Previous message: SecuriTeam: "[NEWS] PalmOS httpd accept() Queue Overflow DoS"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 11 Feb 2004 14:23:14 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Microsoft ASN.1 Library Vulnerability Could Allow Code Execution
(MS04-007)
------------------------------------------------------------------------

SUMMARY

A security vulnerability exists in the Microsoft ASN.1 Library that could
allow code execution on an affected system. The vulnerability is caused by
an unchecked buffer in the Microsoft ASN.1 Library, which could result in
a buffer overflow.

An attacker who successfully exploited this buffer overflow vulnerability
could execute code with system privileges on an affected system. The
attacker could then take any action on the system, including installing
programs, viewing data, changing data, deleting data, or creating new
accounts with full privileges.

Abstract Syntax Notation 1 (ASN.1) is a data standard that is used by many
applications and devices in the technology industry for allowing the
normalization and understanding of data across various platforms. More
information about ASN.1 can be found in Microsoft Knowledge Base Article
<http://support.microsoft.com/default.aspx?scid=kb;en-%20us;252648>
252648.

DETAILS

Affected Components:
* Microsoft ASN.1 Library

Mitigating Factors
In the most likely exploitable scenario, an attacker would have to have
direct access to the user's network.

Vulnerability Identifier
Multiple integer overflows in Microsoft ASN.1 library
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818>
CAN-2003-0818

Workarounds
There are no applicable workarounds. It is highly advisable to download
and install the necessary update.

Frequently Asked Questions
What is the scope of the vulnerability ?
This is a buffer overrun vulnerability. An attacker who successfully
exploited this vulnerability could gain complete control over an affected
system. An attacker could take any action on the system, including
installing programs, viewing data, changing data, deleting data, or
creating new accounts with full privileges.

What causes the vulnerability ?
The vulnerability is caused by an unchecked buffer in the Microsoft ASN.1
Library. If exploited, an attacker could gain system privileges on an
affected system.

What is ASN.1 ?
Abstract Syntax Notation 1 (ASN.1) is a data standard that is used by many
applications and devices in the technology industry for allowing the
normalization and understanding of data across various platforms. ASN.1
has no direct relationship to any specific standard, encoding method,
programming language, or hardware platform. It is simply a language for
defining standards. Or in other words, standards are written in ASN.1.

A vulnerability exists in Microsoft's ASN.1 implementation that, if
exploited, could allow an attacker to cause code to execute remotely with
system privileges on an affected system. More information about ASN.1 can
be found in Microsoft Knowledge Base Article
<http://support.microsoft.com/default.aspx?scid=kb;en-us;252648> 252648.

What might an attacker use the vulnerability to do ?
If successfully exploited, the attacker could be able to take any action
on the system, including installing programs, viewing data, changing data,
deleting data, or creating new accounts with full privileges.

How could an attacker exploit this vulnerability ?
Because ASN.1 is a standard for many applications and devices, there are
many potential attack vectors. To successfully exploit this vulnerability,
an attacker must force a computer to decode malformed ASN.1 data. For
example, when using authentication protocols based on ASN.1 it could be
possible to construct a malformed authentication request that could expose
this vulnerability.

What systems are primarily at risk from this vulnerability ?
Server systems are at greater risk than client computers because they are
more likely to have a server process running that decodes ASN.1 data.

I'm using Windows NT 4.0. How do I know if I need this update ?
Windows NT 4.0 (Workstation, Server, and Terminal Server Edition) does not
install the affected file by default. This file is installed as part of
the <http://www.microsoft.com/technet/security/bulletin/MS03-041.asp>
MS03-041 Windows NT 4.0 security update and other possible
non-security-related hotfixes. If the Windows NT 4.0 security update for
<http://www.microsoft.com/technet/security/bulletin/MS03-041.asp> MS03-041
is not installed, this may not be a required update. To verify if the
affected file is installed, search for the file named Msasn1.dll. If this
file is present, this security update is required. Windows Update,
Software Update Services, and the Microsoft Security Baseline Analyzer
will also correctly detect if this update is required.

What does the update do ?
The update removes the vulnerability by modifying the handling of
malformed data by the ASN.1 Library.

ADDITIONAL INFORMATION

The information has been provided by Microsoft Product Security.

The original article can be found at:
<http://www.microsoft.com/technet/security/bulletin/MS04-007.asp>
http://www.microsoft.com/technet/security/bulletin/MS04-007.asp.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Next message: SecuriTeam: "[NT] Vulnerability in the Windows Internet Naming Service (WINS) Could Allow Code Execution (MS04-006)"

Previous message: SecuriTeam: "[NEWS] PalmOS httpd accept() Queue Overflow DoS"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

SecurityFocus Microsoft Newsletter #176
... MICROSOFT VULNERABILITY SUMMARY ... Microsoft Windows XP HCP URI Handler
Arbitrary Command Execu... ... PHPNuke Category Parameter SQL Injection Vulnerability ...
Microsoft Baseline Security Analyzer Vulnerability Identific... ... (Focus-Microsoft)
SecurityFocus Microsoft Newsletter #242
... MICROSOFT VULNERABILITY SUMMARY ... PostNuke Blocks Module Directory Traversal
Vulnerability ... Groove Networks Groove Virtual Office COM Object Security By... ...
The Microsoft Windows IPV6 TCP/IP stack is prone to a "loopback" condition initiated by sending
a TCP packet with the "SYN" flag set and the source address and port spoofed to equal the destination
source and port. ... (Focus-Microsoft)
[NT] Cumulative Security Update for Internet Explorer (MS04-025)
... Get your security news from a reliable source. ... * Microsoft Windows
NT Workstation 4.0 Service Pack 6a ... Navigation Method Cross-Domain Vulnerability ...
(Securiteam)
SecurityFocus Microsoft Newsletter # 87
... Meeting IT Security Benchmarks Through IT Audits ... MICROSOFT VULNERABILITY
SUMMARY ... Bypassing Windows 2000 Domain Password settings ... (Focus-Microsoft)
SecurityFocus Microsoft Newsletter #75
... Microsoft's Internet Security & Acceleration Server with fault-tolerance ...
The Microsoft UPnP Vulnerability ... Relevant URL: ... (Focus-Microsoft)