CERT-In Advisory CIAD-2004-05
ASN.1 Vulnerability Could Allow Code Execution

Original issue date: February 11, 2004

Severity: High

Systems Affected

• Microsoft Windows NT 4.0
• Microsoft Windows NT Server 4.0 Terminal Server Edition
• Microsoft Windows 2000
• Microsoft Windows XP
• Microsoft Windows Server 2003

Overview

Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with very large length fields that cause arbitrary heap data to be overwritten.

Impact

The security vulnerability in Microsoft ASN.1 library allows remote attackers to execute arbitrary code on an affected system with system privileges which results in a buffer overflow. This occurs due to an unchecked buffer in the Microsoft ASN.1 Library

Description

A vulnerability exists in Microsoft's ASN.1 implementation that, if exploited, could allow an attacker to execute arbitrary code remotely, with system privileges, on an affected system.

Abstract Syntax Notation One (more commonly known as ASN.1) is a language for defining standards without regard to the implementation. It is the language of standards writers. ASN.1 facilitates communication between professionals and committee members by offering a common language for describing a standard.

SN.1 has no regard to any specific standard, encoding method, programming language, or hardware platform. It is simply a language for defining standards.

Solution

Apply patch

Apply the appropriate patch from Microsoft Security Bulletin MS 04-007.

Vendor Information

Microsoft
http://www.microsoft.com/technet/treeview/? url=/technet/security/bulletin/MS04-007.asp

References

US-CERT Technical Cyber Security Alert TA04-041A
Multiple Vulnerabilities in Microsoft ASN.1 Library
http://www.us-cert.gov/cas/techalerts/TA04-041A.html

CVE ID CAN-2003-0818
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818

CERT/CC Vulnerability Note VU#216324
http://www.kb.cert.org/vuls/id/216324

CERT/CC Vulnerability Note VU#583108
http://www.kb.cert.org/vuls/id/583108

eEye Digital Security Advisory AD20040210
http://www.eeye.com/html/Research/ Advisories/AD20040210.html

eEye Digital Security Advisory AD20040210-2
http://www.eeye.com/html/Research/Advisories /AD20040210-2.html

Microsoft Security Bulletin MS04-007
http://microsoft.com/technet/security/bulletin/MS04-007.asp

Microsoft Knowledge Base Article 252648
http://support.microsoft.com/default.aspx?scid=252648.

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Phone: +91 11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003