1. /
  2. Security Response/
  3. Microsoft ASN.1 Library Length Integer Mishandling Memory Corruption Vulnerability

Microsoft ASN.1 Library Length Integer Mishandling Memory Corruption Vulnerability

Risk

High

Date Discovered

February 10, 2004

Description

A vulnerability has been reported in the Microsoft ASN.1 library. This issue is related to insufficient checking of data supplied via an externally supplied length field in ASN.1 BER encoded data. This could result in an excessive value being used in a heap allocation routine, allowing for large amounts of heap memory to be corrupted. This could be leveraged to corrupt sensitive values in memory, resulting in execution of arbitrary code. This vulnerability is exposed in a number of security related operating system components, including Kerberos (via UDP port 88), Microsoft IIS with SSL support enabled and NTLMv2 authentication (via TCP ports 135, 139 and 445). Other components may also be affected, though a comprehensive list is not available at this time. It should be noted that because ASN.1 data will likely be encoded, for example Kerberos, SSL, IPSec or Base64 encoded, the malicious integer values may be obfuscated and as a result not easily detectable.

Technologies Affected

  • AOL Instant Messenger 5.0.2938
  • AOL Instant Messenger 5.1.3036
  • AOL Instant Messenger 5.2.3292
  • Intuit Quicken 2003
  • Microsoft Exchange Server 2000
  • Microsoft Exchange Server 2000 SP1
  • Microsoft Exchange Server 2000 SP2
  • Microsoft Exchange Server 2000 SP3
  • Microsoft Exchange Server 2003
  • Microsoft IIS 5.0
  • Microsoft IIS 5.1
  • Microsoft IIS 6.0
  • Microsoft Internet Explorer 6.0
  • Microsoft Internet Explorer 6.0 SP1
  • Microsoft Small Business Server 2000
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Advanced Server SP3
  • Microsoft Windows 2000 Advanced Server SP4
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional SP2
  • Microsoft Windows 2000 Professional SP3
  • Microsoft Windows 2000 Professional SP4
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Server SP3
  • Microsoft Windows 2000 Server SP4
  • Microsoft Windows 98
  • Microsoft Windows 98SE
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Server 4.0 SP1
  • Microsoft Windows NT Server 4.0 SP2
  • Microsoft Windows NT Server 4.0 SP3
  • Microsoft Windows NT Server 4.0 SP4
  • Microsoft Windows NT Server 4.0 SP5
  • Microsoft Windows NT Server 4.0 SP6
  • Microsoft Windows NT Server 4.0 SP6a
  • Microsoft Windows NT Terminal Server 4.0
  • Microsoft Windows NT Terminal Server 4.0 SP1
  • Microsoft Windows NT Terminal Server 4.0 SP2
  • Microsoft Windows NT Terminal Server 4.0 SP3
  • Microsoft Windows NT Terminal Server 4.0 SP4
  • Microsoft Windows NT Terminal Server 4.0 SP5
  • Microsoft Windows NT Terminal Server 4.0 SP6
  • Microsoft Windows NT Workstation 4.0
  • Microsoft Windows NT Workstation 4.0 SP1
  • Microsoft Windows NT Workstation 4.0 SP2
  • Microsoft Windows NT Workstation 4.0 SP3
  • Microsoft Windows NT Workstation 4.0 SP4
  • Microsoft Windows NT Workstation 4.0 SP5
  • Microsoft Windows NT Workstation 4.0 SP6
  • Microsoft Windows NT Workstation 4.0 SP6a
  • Microsoft Windows Server 2003 Datacenter Edition
  • Microsoft Windows Server 2003 Datacenter Edition Itanium
  • Microsoft Windows Server 2003 Enterprise Edition
  • Microsoft Windows Server 2003 Enterprise Edition Itanium
  • Microsoft Windows Server 2003 Standard Edition
  • Microsoft Windows Server 2003 Web Edition
  • Microsoft Windows XP 64-bit Edition
  • Microsoft Windows XP 64-bit Edition SP1
  • Microsoft Windows XP 64-bit Edition Version 2003
  • Microsoft Windows XP 64-bit Edition Version 2003 SP1
  • Microsoft Windows XP Home
  • Microsoft Windows XP Home SP1
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Professional SP1
  • Van Dyke Technologies SecureCRT 2.4.0
  • Van Dyke Technologies SecureCRT 3.0.0
  • Van Dyke Technologies SecureCRT 3.1.0
  • Van Dyke Technologies SecureCRT 3.1.1
  • Van Dyke Technologies SecureCRT 3.1.2
  • Van Dyke Technologies SecureCRT 3.2.0
  • Van Dyke Technologies SecureCRT 3.2.1
  • Van Dyke Technologies SecureCRT 3.2.2
  • Van Dyke Technologies SecureCRT 3.3.0
  • Van Dyke Technologies SecureCRT 3.3.1
  • Van Dyke Technologies SecureCRT 3.3.2
  • Van Dyke Technologies SecureCRT 3.3.3
  • Van Dyke Technologies SecureCRT 3.3.4
  • Van Dyke Technologies SecureCRT 3.4.0
  • Van Dyke Technologies SecureCRT 3.4.1
  • Van Dyke Technologies SecureCRT 3.4.2
  • Van Dyke Technologies SecureCRT 3.4.3
  • Van Dyke Technologies SecureCRT 3.4.4
  • Van Dyke Technologies SecureCRT 3.4.5
  • Van Dyke Technologies SecureCRT 3.4.6
  • Van Dyke Technologies SecureCRT 3.4.7
  • Van Dyke Technologies SecureCRT 3.4.8
  • Van Dyke Technologies SecureCRT 4.0.1
  • Van Dyke Technologies SecureCRT 4.0.2
  • Van Dyke Technologies SecureCRT 4.0.3
  • Van Dyke Technologies SecureCRT 4.0.4
  • Van Dyke Technologies SecureCRT 4.0.5
  • Yahoo! Messenger 5.6.0
  • Yahoo! Messenger 5.6.0 .0.1347
  • Yahoo! Messenger 5.6.0 .0.1351
  • Yahoo! Messenger 5.6.0 .0.1355
  • Yahoo! Messenger 5.6.0 .0.1356
  • Yahoo! Messenger 5.6.0 .0.1358

Recommendations

Block external access at the network boundary, unless external parties require service.

If possible, filter ASN.1 based communications at the network perimeter. Allow communications for trusted hosts and networks only. This includes explicitly disallowing access to any services that may depend upon the vulnerable library, such as Kerberos via UDP port 88, Microsoft IIS and authentication via NTLMv2 on TCP ports 135, 139 and 445.

Run all software as a nonprivileged user with minimal access rights.

This issue could theoretically be exposed via various client applications on affected platforms, such as Internet Explorer and Outlook. Non-administrative tasks, such as using various network clients, should always be performed as an unprivileged user with minimal access rights.
It has been alleged that an official patch to address this issue in Microsoft Windows 98 systems is available to customers who possess a current support contract with Microsoft. Customers are advised to contact their relative Microsoft TAM, in order to obtain a relevant patch. Microsoft has released a security update (MS04-007) to address this issue in affected versions of Microsoft Windows. Users are strongly advised to obtain fixes as soon as possible. Avaya has released an advisory to address this and another issue. Please see the advisory at the following location for more information: http://support.avaya.com/japple/css/japple?temp.groupID=&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=159748&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()

Credits

Discovery of this vulnerability has been credited to eEye Digital Security.
Copyright © Symantec Corporation.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com.

Disclaimer
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Symantec, Symantec products, Symantec Security Response, and secure@symantec.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.

Threat Intelligence

Subscribe
Follow the Threat Intelligence Twitter feed
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver