bugtraq - Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040211115923.GJ11154@straylight.m.ringlet.net>
Date: Wed, 11 Feb 2004 13:59:24 +0200
From: Peter Pentchev <roam@...glet.net>
To: Tim Eddy <eddyt@...eorge.com.au>
Cc: mmaiffret@...e.com, tbird@...cision-guesswork.com,
	BUGTRAQ@...urityfocus.com, sd_wireless@...oo.com
Subject: Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption

On Wed, Feb 11, 2004 at 09:16:40AM +1100, Tim Eddy wrote:
> Marc,
> 
> If we remove the default exemptions for Kerberos & RSVP from IPSEC with
> the "NoDefaultExempt" registry key, this still passes IKE. Therefore is
> IKE vulnerable to the ASN bug?

It would appear that it is indeed.  The Internet Key Exchange protocol
is defined in RFC 2409, and section 5.2, "Phase 1 Authentication With
Public Key Encryption", states that "RSA encryption MUST be encoded in
PKCS #1 format".  The PKCS #1 standard always uses ASN.1 to encode
the keys and signature schemes used.

G'luck,
Peter

-- 
Peter Pentchev	roam@...glet.net    roam@...d.net    roam@...eBSD.org
PGP key:	http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint	FDBA FD79 C26F 3C51 C95E  DF9E ED18 B68D 1619 4553
If this sentence didn't exist, somebody would have invented it.

Content of type "application/pgp-signature" skipped