bugtraq - RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 10 Feb 2004 12:47:29 -0800
From: "Marc Maiffret" <mmaiffret@...e.com>
To: "Tina Bird" <tbird@...cision-guesswork.com>
Cc: "Joe Blatz" <sd_wireless@...oo.com>, <BUGTRAQ@...urityfocus.com>
Subject: RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption

Yes, I am not sure what Microsoft did with the wording there that seems
to be misleading to at least a few people so far.

There is just as much, if not more, chance of people using this
vulnerability on server side applications as there is on client-side
applications.

For example we setup a totally IPSEC secured network and we broke into
that network via our ASN bug which is called by the Kerberos. We also
have written exploits that take advantage of ASN via NTLMv2
authentication. And the list goes on... How about evil ASN SSL CERTs?
Client or server? There is a menu a mile long for the avenues of attacks
that this thing can be used for.

If your running, Windows NT 4.0, Windows 2000, Windows XP, or Windows
2003, you are 99.9999% positive to be vulnerable, regardless of what
your configuration might be. Don't try to guess if you have any of the
affected protocols or applications (lets not forget third party apps
using the MS ASN library), just install the patch. 

Client side, server side, world wide.

Signed,
Marc Maiffret
Chief Hacking Officer
eEye Digital Security
T.949.349.9062
F.949.349.9538
http://eEye.com/Retina - Network Security Scanner
http://eEye.com/Iris - Network Traffic Analyzer
http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities 

Important Notice: This email is confidential, may be legally privileged,
and is for the intended recipient only. Access, disclosure, copying,
distribution, or reliance on any of it by anyone else is prohibited and
may be a criminal offense.  Please delete if obtained in error and email
confirmation to the sender. 

| -----Original Message-----
| From: Tina Bird [mailto:tbird@...cision-guesswork.com] 
| Sent: Tuesday, February 10, 2004 12:41 PM
| To: Marc Maiffret
| Cc: Joe Blatz; BUGTRAQ@...urityfocus.com
| Subject: RE: EEYE: Microsoft ASN.1 Library Length Overflow 
| Heap Corruption
| 
| 
| On Tue, 10 Feb 2004, Marc Maiffret wrote:
| 
| > This attack can be performed through various encryption 
| systems such 
| > as Kerberos and almost anything using CERTs... I am not sure about 
| > Microsofts wording in their advisory.
| 
| Microsoft also states that servers are likelier to be 
| attacked using this vulnerability than clients are, because 
| they're likelier to be decoding
| ASN.1 data.  But if the vulnerable code can be accessed via 
| LSASS.exe, doesn't that mean all systems are at risk?
| 
| thanks for any info -- tbird
| 
| --
| It doesn't have to be our fault to be our responsibility.
| 
|                                  -- Paul Robertson
| 
| http://www.precision-guesswork.com
| Log Analysis http://www.loganalysis.org
| VPN http://vpn.shmoo.com
| tbird's Security Alerts http://securecomputing.stanford.edu/alert.html
|