RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption
From: Rainer Gerhards (rgerhards_at_hq.adiscon.com)
Date: 02/10/04
- Previous message: Advisories: "Microsoft Virtual PC Services Insecure Temporary File Creation"
- Maybe in reply to: Marc Maiffret: "EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption"
- Next in thread: Tina Bird: "RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption"
- Reply: Tina Bird: "RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption"
- Reply: Alun Jones: "RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 10 Feb 2004 22:36:07 +0100 To: "Tina Bird" <tbird@precision-guesswork.com>, "Marc Maiffret" <mmaiffret@eeye.com>
I think Microsoft is using wording to keep the typical end user in a
warm and cozy state. Technically, except for AD services, each client
has a full server implementation and as such should be vulnerable. I
assume that many of those DSL-connected, non-firewalled home machines
are easy targets.
And that the server is more likely to be attacked is just an assumption
- in the days of class A vuln sweeps and random worm scans, I don't
think that servers are at most risk. In fact, I think the unprotected
home machines are...
Rainer
> -----Original Message-----
> From: Tina Bird [mailto:tbird@precision-guesswork.com]
> Sent: Tuesday, February 10, 2004 9:41 PM
> To: Marc Maiffret
> Cc: Joe Blatz; BUGTRAQ@securityfocus.com
> Subject: RE: EEYE: Microsoft ASN.1 Library Length Overflow
> Heap Corruption
>
>
> On Tue, 10 Feb 2004, Marc Maiffret wrote:
>
> > This attack can be performed through various encryption
> systems such as
> > Kerberos and almost anything using CERTs... I am not sure about
> > Microsofts wording in their advisory.
>
> Microsoft also states that servers are likelier to be
> attacked using this
> vulnerability than clients are, because they're likelier to
> be decoding
> ASN.1 data. But if the vulnerable code can be accessed via LSASS.exe,
> doesn't that mean all systems are at risk?
>
> thanks for any info -- tbird
>
> --
> It doesn't have to be our fault to be our responsibility.
>
> -- Paul Robertson
>
> http://www.precision-guesswork.com
> Log Analysis http://www.loganalysis.org
> VPN http://vpn.shmoo.com
> tbird's Security Alerts http://securecomputing.stanford.edu/alert.html
>
- Previous message: Advisories: "Microsoft Virtual PC Services Insecure Temporary File Creation"
- Maybe in reply to: Marc Maiffret: "EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption"
- Next in thread: Tina Bird: "RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption"
- Reply: Tina Bird: "RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption"
- Reply: Alun Jones: "RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
