Multiple Vulnerabilities in Microsoft ASN.1 Library

Systems Affected

• Microsoft Windows NT 4.0
• Microsoft Windows NT 4.0 TSE
• Microsoft Windows 2000
• Microsoft Windows XP
• Microsoft Windows Server 2003

Overview

Multiple integer overflow vulnerabilities in the Microsoft Windows ASN.1 parser library could allow an unauthenticated, remote attacker to execute arbitrary code with SYSTEM privileges.

I. Description

Abstract Syntax Notation number One (ASN.1) is an international standard used to describe and transmit data packets between applications and across networks. Microsoft Security Bulletin MS04-007 announces a patch for multiple vulnerabilities in the Microsoft Windows ASN.1 library (msasn1.dll). According to information from eEye Digital Security, the vulnerabilities involve integer overflows and other flaws in integer arithmetic. More information is available in two vulnerability notes:

VU#216324 - Microsoft ASN.1 Library improperly decodes malformed ASN.1 length values
(Other resources: AD20040210, MS04-007, CAN-2003-0818)

VU#583108 - Microsoft ASN.1 Library improperly decodes constructed bit strings
(Other resources: AD20040210-2, MS04-007, CAN-2003-0818)

eEye has published two detailed advisories on these issues: AD20040210 and AD20040210-2.

Any application that loads the ASN.1 library could serve as an attack vector. In particular, ASN.1 is used by a number of cryptographic and authentication services such as X.509 certificates (SSL/TLS, S/MIME, IKE), Kerberos, and NTLMv2. The Local Security Authority Subsystem (lsass.exe) and a component of the CryptoAPI (crypt32.dll) use the vulnerable ASN.1 library. Both client and server systems are affected.

II. Impact

An unauthenticated, remote attacker could execute arbitrary code with the privileges of the process using the ASN.1 library. In the case of most server and authentication applications, an attacker could gain SYSTEM privileges.

III. Solution

Apply a patch

Apply the appropriate patch as specified by Microsoft Security Bulletin MS04-007.

Appendix A. Vendor Information

This appendix contains information provided by vendors. When vendors report new information, this section is updated and the changes are noted in the revision history. If a vendor is not listed below, we have not received their comments.

Microsoft

Please see Microsoft Security Bulletin MS04-007.

Appendix B. References

• Vulnerability Note VU#216324 - <http://www.kb.cert.org/vuls/id/216324>
• Vulnerability Note VU#583108 - <http://www.kb.cert.org/vuls/id/583108>
• eEye Digital Security Advisory AD20040210 - <http://www.eeye.com/html/Research/Advisories/AD20040210.html>
• eEye Digital Security Advisory AD20040210-2 - <http://www.eeye.com/html/Research/Advisories/AD20040210-2.html>
• Microsoft Security Bulletin MS04-007 - <http://microsoft.com/technet/security/bulletin/MS04-007.asp>
• Microsoft Knowledge Base Article 252648 - <http://support.microsoft.com/default.aspx?scid=252648>

These vulnerabilities were researched and reported by eEye Digital Security. Information from eEye and Microsoft was used in this document.

Feedback can be directed to the author, Art Manion.

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

February 10, 2004: Initial release
February 12, 2004: Added ASN.1 definition, updated description of applications that use ASN.1