RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption

From: Rainer Gerhards (rgerhards_at_hq.adiscon.com)
Date: 02/11/04

  • Next message: bool_at_gte.net: "Internet Explorer and Microsoft clipboard poor security policy" 
    Date: Wed, 11 Feb 2004 10:10:32 +0100
To: "Tina Bird" <tbird@precision-guesswork.com>

    > > And that the server is more likely to be attacked is just
    > an assumption
    > > - in the days of class A vuln sweeps and random worm scans, I don't
    > > think that servers are at most risk. In fact, I think the
    > unprotected
    > > home machines are...
    > >
    > Yes, but...
    >
    > In order to trigger the ASN.1 vulnerabilities an attacker has
    > to be able
    > to get the target machine to invoke its BER decoding capabilities. I
    > certainly don't know the details -- maybe someone here does?
    > -- but it's
    > gotta be a little difficult to send a random network packet to get a
    > desktop machine (that is, not a domain controller or an AD server or
    > something) and get it to invoke MSASN1.

    As of my understanding (I haven't tried to reproduce, just theory here),
    ASN.1 is not only used for AD, but also for NTLM authentication. Even if
    that is not the case, there are several cases where ASN.1 is used. And
    "invoking BER decoding capabilities" (from the MS Advisory) may sound
    like something seldomly done... In fact, if you receive ASN.1 on the
    wire, you need to decode BER because this is the way you get hold of the
    message content. It is the same thing as "decoding the SMTP message" is
    a bare necessity for any mail server because it otherwise can not talk
    SMTP ;)

    As someone else pointed out, there is also a potential large multitude
    of third party apps which rely on the Microsoft lib. This alone is a
    good indication an update is needed.

    But I think the bottom line of all this is if a box is listening to 135,
    139 OR 445, it is vulnerable. And workstations by default listen to this
    ports.

    [A good thing to keep in mind is that for NT4/Win2000 it was just a
    registry switch that told the software if it is a server or workstation
    os. In essence, almost all services are still the same. AD is an
    exception, but there are still an awful lot of server services running
    on the workstation - they must, e.g. for peer-to-peer file and printer
    sharing...].

    >
    > I can imagine lots of attacks that require user intervention
    > to hit this
    > one (like opening a hostile SSL-based web site) -- but can this be
    > triggered without user intervention?

    I am pretty sure it can.

    Rainer

  • Next message: bool_at_gte.net: "Internet Explorer and Microsoft clipboard poor security policy"

    Relevant Pages

    • RE: Is this as bad as it seems?
      ... The network being protected by the router or firewall is still vulnerable to ... > circumvented - the administrator has explicitly allowed HTTP traffic on ... this exploit has the effect of allowing the attacker to send *INBOUND* HTTP ... The HTTP server (located on the internal network or anywhere else that is ...
      (Security-Basics)
    • [NEWS] Firewall Circumvention Possible with All Browsers
      ... The exploit allows an attacker to use any JavaScript-enabled web browser ... any HTTP server behind the firewall. ... outlined in the section "Quick-Swap DNS". ... If the client in use is Microsoft Internet Explorer, ...
      (Securiteam)
    • [NT] Unchecked Buffer in Network Share Provider Can Lead to Denial of Service
      ... SMB (Server Message Block) is the protocol Microsoft uses to share files, ... The attacker could use both a user account and anonymous access to ... What's the scope of the vulnerability? ...
      (Securiteam)
    • RE: Private addresses on public network
      ... anybody accesses those computers from an external network," -- even when the ... JavaScript delivered to the client that causes the client to retrieve ... the attacker, the request results in another JavaScript response that tells ... Moving beyond a single server ...
      (Security-Basics)
    • Re: Appeal for Help. NOT Code Red But Is It?
      ... our server immediately responds back to the prober ... What is happening is that the IDS is becomming confused about who the ... each worm that is still on its way from the attacker. ... > and outbound port was 2913. ...
      (Incidents)