February 10, 2004
A vulnerability has been reported in the Microsoft ASN.1 library. This issue is related to insufficient checking of data supplied via an externally supplied length field in ASN.1 BER encoded data. This could result in an excessive value being used in a heap allocation routine, allowing for large amounts of heap memory to be corrupted. This could be leveraged to corrupt sensitive values in memory, resulting in execution of arbitrary code.
This vulnerability is exposed in a number of security related operating system components, including Kerberos (via UDP port 88), Microsoft IIS with SSL support enabled and NTLMv2 authentication (via TCP ports 135, 139 and 445). Other components may also be affected, though a comprehensive list is not available at this time.
It should be noted that because ASN.1 data will likely be encoded, for example Kerberos, SSL, IPSec or Base64 encoded, the malicious integer values may be obfuscated and as a result not easily detectable.
Block external access at the network boundary, unless external parties require service.
If possible, filter ASN.1 based communications at the network perimeter. Allow communications for trusted hosts and networks only. This includes explicitly disallowing access to any services that may depend upon the vulnerable library, such as Kerberos via UDP port 88, Microsoft IIS and authentication via NTLMv2 on TCP ports 135, 139 and 445.
Run all software as a nonprivileged user with minimal access rights.
This issue could theoretically be exposed via various client applications on affected platforms, such as Internet Explorer and Outlook. Non-administrative tasks, such as using various network clients, should always be performed as an unprivileged user with minimal access rights.
It has been alleged that an official patch to address this issue in Microsoft Windows 98 systems is available to customers who possess a current support contract with Microsoft. Customers are advised to contact their relative Microsoft TAM, in order to obtain a relevant patch.
Microsoft has released a security update (MS04-007) to address this issue in affected versions of Microsoft Windows. Users are strongly advised to obtain fixes as soon as possible.
Avaya has released an advisory to address this and another issue. Please see the advisory at the following location for more information:
Discovery of this vulnerability has been credited to eEye Digital Security.
Copyright © Symantec Corporation.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from firstname.lastname@example.org
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Symantec, Symantec products, Symantec Security Response, and email@example.com
are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.