Bugtraq mailing list archives
RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption
From: "Tim Eddy" <eddyt () stgeorge com au>
Date: Wed, 11 Feb 2004 09:16:40 +1100
Marc, If we remove the default exemptions for Kerberos & RSVP from IPSEC with the "NoDefaultExempt" registry key, this still passes IKE. Therefore is IKE vulnerable to the ASN bug? Thanks, Tim
"Marc Maiffret" <mmaiffret () eeye com> 11/02/2004 7:47:29 am >>>
Yes, I am not sure what Microsoft did with the wording there that seems to be misleading to at least a few people so far. There is just as much, if not more, chance of people using this vulnerability on server side applications as there is on client-side applications. For example we setup a totally IPSEC secured network and we broke into that network via our ASN bug which is called by the Kerberos. We also have written exploits that take advantage of ASN via NTLMv2 authentication. And the list goes on... How about evil ASN SSL CERTs? Client or server? There is a menu a mile long for the avenues of attacks that this thing can be used for. If your running, Windows NT 4.0, Windows 2000, Windows XP, or Windows 2003, you are 99.9999% positive to be vulnerable, regardless of what your configuration might be. Don't try to guess if you have any of the affected protocols or applications (lets not forget third party apps using the MS ASN library), just install the patch. Client side, server side, world wide. Signed, Marc Maiffret Chief Hacking Officer eEye Digital Security T.949.349.9062 F.949.349.9538 http://eEye.com/Retina - Network Security Scanner http://eEye.com/Iris - Network Traffic Analyzer http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities Important Notice: This email is confidential, may be legally privileged, and is for the intended recipient only. Access, disclosure, copying, distribution, or reliance on any of it by anyone else is prohibited and may be a criminal offense. Please delete if obtained in error and email confirmation to the sender. | -----Original Message----- | From: Tina Bird [mailto:tbird () precision-guesswork com] | Sent: Tuesday, February 10, 2004 12:41 PM | To: Marc Maiffret | Cc: Joe Blatz; BUGTRAQ () securityfocus com | Subject: RE: EEYE: Microsoft ASN.1 Library Length Overflow | Heap Corruption | | | On Tue, 10 Feb 2004, Marc Maiffret wrote: | | > This attack can be performed through various encryption | systems such | > as Kerberos and almost anything using CERTs... I am not sure about | > Microsofts wording in their advisory. | | Microsoft also states that servers are likelier to be | attacked using this vulnerability than clients are, because | they're likelier to be decoding | ASN.1 data. But if the vulnerable code can be accessed via | LSASS.exe, doesn't that mean all systems are at risk? | | thanks for any info -- tbird | | -- | It doesn't have to be our fault to be our responsibility. | | -- Paul Robertson | | http://www.precision-guesswork.com | Log Analysis http://www.loganalysis.org | VPN http://vpn.shmoo.com | tbird's Security Alerts http://securecomputing.stanford.edu/alert.html | ********************************************************************** ***** IMPORTANT INFORMATION ***** This document should be read only by those persons to whom it is addressed and its content is not intended for use by any other persons. If you have received this message in error, please notify us immediately. Please also destroy and delete the message from your computer. Any unauthorised form of reproduction of this message is strictly prohibited. St.George is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt. **********************************************************************
Current thread:
- EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Marc Maiffret (Feb 10)
- <Possible follow-ups>
- RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Joe Blatz (Feb 10)
- RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Marc Maiffret (Feb 10)
- RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Tina Bird (Feb 10)
- Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption James Riden (Feb 11)
- RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Marc Maiffret (Feb 10)
- RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption peter.huang (Feb 12)
- RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Tim Eddy (Feb 10)
- Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Peter Pentchev (Feb 12)
- Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Timothy J . Miller (Feb 12)
- Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Florian Weimer (Feb 16)
- RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Rainer Gerhards (Feb 10)
- RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Tina Bird (Feb 11)
- RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Alun Jones (Feb 11)
- RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Rainer Gerhards (Feb 11)
- Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Steve Friedl (Feb 12)
- Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Thor Lancelot Simon (Feb 13)
- Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Buck Huppmann (Feb 16)
(Thread continues...)