bugtraq - Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040214164658.GA17883@dsl092-163-146.wdc2.dsl.speakeasy.net>
Date: Sat, 14 Feb 2004 11:46:58 -0500
From: Buck Huppmann <buckh@...ox.com>
To: Thor Lancelot Simon <tls@....tjls.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption


On Fri, Feb 13, 2004 at 01:04:31AM -0500, Thor Lancelot Simon wrote:

> So you can't reasonably assume that if it uses ASN.1, it uses
> BER.  That's presumably why Microsoft left certain ASN.1-using
> network services turned on.

perhaps it doesn't emit BER on the sending side, but on the receiving
end, it probably just hands DER off to a generalized BER decoder, given
that DER is a subset of BER. i'm very probably wrong (and i apologize in
advance and ask that you not flame too intensely in rebuttal), but in
OpenSSL, say, it seems that the decoding functions accept either DER or
more generalized BER. this certainly doesn't prove anything, but

$ perl -ne 'print pack "C", hex $_' | openssl asn1parse -inform DER
0x33 # printable string, constructed encoding--this isn't legal DER
0x80 # indefinite length--illegal DER also, for a printable-string, anyway
0x13 # printable string, primitive encoding
0x81 # 1 length byte follows--this isn't legal DER either, i don't think
0x03 # length: 3 bytes
0x66 # 'f'
0x6f # 'o'
0x6f # 'o'
0x13 # printable string, primitive encoding--this is the distinguished form
0x01 # length: 1 byte
0x10 # '\n'
0x00 # eoc 
0x00 # indicator
    0:d=0  hl=2 l=inf  cons: PRINTABLESTRING   
    2:d=1  hl=3 l=   3 prim: PRINTABLESTRING   :foo
    8:d=1  hl=2 l=   1 prim: PRINTABLESTRING   :
   11:d=1  hl=2 l=   0 prim: EOC               

which says nothing about how Microsoft does it, but i wouldn't assume
they have separate DER and BER parsing routines