RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption

From: Tim Eddy (eddyt_at_stgeorge.com.au)
Date: 02/10/04

  • Next message: Advisories: "Microsoft Virtual PC Services Insecure Temporary File Creation" 
    Date: Wed, 11 Feb 2004 09:16:40 +1100
To: <mmaiffret@eeye.com>, <tbird@precision-guesswork.com>

    Marc,

    If we remove the default exemptions for Kerberos & RSVP from IPSEC with
    the "NoDefaultExempt" registry key, this still passes IKE. Therefore is
    IKE vulnerable to the ASN bug?

    Thanks,
    Tim

    >>> "Marc Maiffret" <mmaiffret@eeye.com> 11/02/2004 7:47:29 am >>>
    Yes, I am not sure what Microsoft did with the wording there that
    seems
    to be misleading to at least a few people so far.

    There is just as much, if not more, chance of people using this
    vulnerability on server side applications as there is on client-side
    applications.

    For example we setup a totally IPSEC secured network and we broke into
    that network via our ASN bug which is called by the Kerberos. We also
    have written exploits that take advantage of ASN via NTLMv2
    authentication. And the list goes on... How about evil ASN SSL CERTs?
    Client or server? There is a menu a mile long for the avenues of
    attacks
    that this thing can be used for.

    If your running, Windows NT 4.0, Windows 2000, Windows XP, or Windows
    2003, you are 99.9999% positive to be vulnerable, regardless of what
    your configuration might be. Don't try to guess if you have any of the
    affected protocols or applications (lets not forget third party apps
    using the MS ASN library), just install the patch.

    Client side, server side, world wide.

    Signed,
    Marc Maiffret
    Chief Hacking Officer
    eEye Digital Security
    T.949.349.9062
    F.949.349.9538
    http://eEye.com/Retina - Network Security Scanner
    http://eEye.com/Iris - Network Traffic Analyzer
    http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities

    Important Notice: This email is confidential, may be legally
    privileged,
    and is for the intended recipient only. Access, disclosure, copying,
    distribution, or reliance on any of it by anyone else is prohibited
    and
    may be a criminal offense. Please delete if obtained in error and
    email
    confirmation to the sender.

    | -----Original Message-----
    | From: Tina Bird [mailto:tbird@precision-guesswork.com]
    | Sent: Tuesday, February 10, 2004 12:41 PM
    | To: Marc Maiffret
    | Cc: Joe Blatz; BUGTRAQ@securityfocus.com
    | Subject: RE: EEYE: Microsoft ASN.1 Library Length Overflow
    | Heap Corruption
    |
    |
    | On Tue, 10 Feb 2004, Marc Maiffret wrote:
    |
    | > This attack can be performed through various encryption
    | systems such
    | > as Kerberos and almost anything using CERTs... I am not sure about

    | > Microsofts wording in their advisory.
    |
    | Microsoft also states that servers are likelier to be
    | attacked using this vulnerability than clients are, because
    | they're likelier to be decoding
    | ASN.1 data. But if the vulnerable code can be accessed via
    | LSASS.exe, doesn't that mean all systems are at risk?
    |
    | thanks for any info -- tbird
    |
    | --
    | It doesn't have to be our fault to be our responsibility.
    |
    | -- Paul Robertson
    |
    | http://www.precision-guesswork.com
    | Log Analysis http://www.loganalysis.org
    | VPN http://vpn.shmoo.com
    | tbird's Security Alerts
    http://securecomputing.stanford.edu/alert.html
    |

    **********************************************************************
    ***** IMPORTANT INFORMATION *****
    This document should be read only by those persons to whom
    it is addressed and its content is not intended for use by
    any other persons. If you have received this message in
    error, please notify us immediately. Please also destroy and
    delete the message from your computer. Any unauthorised form
    of reproduction of this message is strictly prohibited.
    St.George is not liable for the proper and complete transmission
    of the information contained in this communication, nor for any
    delay in its receipt.
    **********************************************************************

  • Next message: Advisories: "Microsoft Virtual PC Services Insecure Temporary File Creation"

    Relevant Pages