1. /
  2. Security Response/
  3. Microsoft Windows ASN.1 Library Bit String Processing Integer Handling Vulnerability

Microsoft Windows ASN.1 Library Bit String Processing Integer Handling Vulnerability

Risk

High

Date Discovered

February 10, 2004

Description

Microsoft ASN.1 handling library has been reported prone to an integer overflow vulnerability that may result in arbitrary heap-based memory corruption. The issue presents itself in the ASN.1 BER decoding/encoding routines. Exploitation of this issue will result in the corruption of heap based management structures, and may ultimately be leveraged by an attacker to have arbitrary code executed in the context of the affected process. This vulnerability is exposed in a number of security related operating system components, including Kerberos (via UDP port 88), Microsoft IIS with SSL support enabled and NTLMv2 authentication (via TCP ports 135, 139 and 445). Other components may also be affected, though a comprehensive list is not available at this time. It should be noted that because ASN.1 data will likely be encoded, for example Kerberos, SSL, IPSec or Base64 encoded, the malicious integer values may be obfuscated and as a result not easily detectable.

Technologies Affected

  • AOL Instant Messenger 5.0.2938
  • AOL Instant Messenger 5.1.3036
  • AOL Instant Messenger 5.2.3292
  • AOL Instant Messenger 5.5.3415 Beta
  • Adobe Acrobat 5.0.0
  • Adobe Acrobat 5.0.5
  • Adobe Acrobat 6.0.0
  • Altova xmlspy Enterprise Edition 2004
  • Altova xmlspy Enterprise Edition 2004 R2
  • Altova xmlspy Home Edition 2004
  • Altova xmlspy Home Edition 2004 R2
  • Altova xmlspy Professional Edition 2004
  • Altova xmlspy Professional Edition 2004 R2
  • Intuit Quicken 2003
  • Intuit TurboTax 2003
  • JASC Software PaintShop Pro 5.0.0
  • JASC Software PaintShop Pro 5.0.0 1
  • JASC Software PaintShop Pro 5.0.0 3
  • JASC Software PaintShop Pro 6.0.0
  • JASC Software PaintShop Pro 6.0.0 1
  • JASC Software PaintShop Pro 6.0.0 2
  • JASC Software PaintShop Pro 7.0.0
  • JASC Software PaintShop Pro 7.0.0 1
  • JASC Software PaintShop Pro 7.0.0 2
  • JASC Software PaintShop Pro 7.0.0 4
  • JASC Software PaintShop Pro 8.0.0 0
  • JASC Software PaintShop Pro 8.0.0 1
  • JASC Software PaintShop Pro 8.10.0
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Advanced Server SP3
  • Microsoft Windows 2000 Advanced Server SP4
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional SP2
  • Microsoft Windows 2000 Professional SP3
  • Microsoft Windows 2000 Professional SP4
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Server SP3
  • Microsoft Windows 2000 Server SP4
  • Microsoft Windows 98
  • Microsoft Windows 98SE
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Server 4.0 SP1
  • Microsoft Windows NT Server 4.0 SP2
  • Microsoft Windows NT Server 4.0 SP3
  • Microsoft Windows NT Server 4.0 SP4
  • Microsoft Windows NT Server 4.0 SP5
  • Microsoft Windows NT Server 4.0 SP6
  • Microsoft Windows NT Server 4.0 SP6a
  • Microsoft Windows NT Terminal Server 4.0
  • Microsoft Windows NT Terminal Server 4.0 SP1
  • Microsoft Windows NT Terminal Server 4.0 SP2
  • Microsoft Windows NT Terminal Server 4.0 SP3
  • Microsoft Windows NT Terminal Server 4.0 SP4
  • Microsoft Windows NT Terminal Server 4.0 SP5
  • Microsoft Windows NT Terminal Server 4.0 SP6
  • Microsoft Windows NT Workstation 4.0
  • Microsoft Windows NT Workstation 4.0 SP1
  • Microsoft Windows NT Workstation 4.0 SP2
  • Microsoft Windows NT Workstation 4.0 SP3
  • Microsoft Windows NT Workstation 4.0 SP4
  • Microsoft Windows NT Workstation 4.0 SP5
  • Microsoft Windows NT Workstation 4.0 SP6
  • Microsoft Windows NT Workstation 4.0 SP6a
  • Microsoft Windows Server 2003 Datacenter Edition
  • Microsoft Windows Server 2003 Datacenter Edition Itanium
  • Microsoft Windows Server 2003 Enterprise Edition
  • Microsoft Windows Server 2003 Enterprise Edition Itanium
  • Microsoft Windows Server 2003 Standard Edition
  • Microsoft Windows Server 2003 Web Edition
  • Microsoft Windows XP 64-bit Edition
  • Microsoft Windows XP 64-bit Edition SP1
  • Microsoft Windows XP 64-bit Edition Version 2003
  • Microsoft Windows XP 64-bit Edition Version 2003 SP1
  • Microsoft Windows XP Home
  • Microsoft Windows XP Home SP1
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Professional SP1
  • Musicmatch Inc. Musicmatch Jukebox 8.0.0
  • Musicmatch Inc. Musicmatch Jukebox 8.1.0
  • Musicmatch Inc. Musicmatch Jukebox 8.2.0
  • Van Dyke Technologies SecureCRT 4.0.1
  • Van Dyke Technologies SecureCRT 4.0.2
  • Van Dyke Technologies SecureCRT 4.0.3
  • Van Dyke Technologies SecureCRT 4.0.4
  • Van Dyke Technologies SecureCRT 4.0.5
  • Yahoo! Messenger 5.5.0
  • Yahoo! Messenger 5.5.0 .1249
  • Yahoo! Messenger 5.6.0
  • Yahoo! Messenger 5.6.0 .0.1347
  • Yahoo! Messenger 5.6.0 .0.1351
  • Yahoo! Messenger 5.6.0 .0.1355
  • Yahoo! Messenger 5.6.0 .0.1356
  • Yahoo! Messenger 5.6.0 .0.1358

Recommendations

Block external access at the network boundary, unless external parties require service.

If possible, filter ASN.1 based communications at the network perimeter. Allow communications for trusted hosts and networks only. This includes explicitly disallowing access to any services that may depend upon the vulnerable library, such as Kerberos via UDP port 88, Microsoft IIS and authentication via NTLMv2 on TCP ports 135, 139 and 445.

Run all software as a nonprivileged user with minimal access rights.

This issue could theoretically be exposed via various client applications on affected platforms, such as Internet Explorer and Outlook. Non-administrative tasks, such as using various network clients, should always be performed as an unprivileged user with minimal access rights.
It has been alleged that an official patch to address this issue in Microsoft Windows 98 systems is available to customers who possess a current support contract with Microsoft. Customers are advised to contact their relative Microsoft TAM, in order to obtain a relevant patch. Microsoft has released a security update (MS04-007) to address this issue in affected versions of Microsoft Windows. Users are strongly advised to obtain fixes as soon as possible. Avaya has released an advisory to address this and another issue. Please see the advisory at the following location for more information: http://support.avaya.com/japple/css/japple?temp.groupID=&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=159748&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()

Credits

Discovery of this vulnerability has been credited to eEye Digital Security.
Copyright © Symantec Corporation.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com.

Disclaimer
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Symantec, Symantec products, Symantec Security Response, and secure@symantec.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.

Threat Intelligence

Subscribe
Follow the Threat Intelligence Twitter feed
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver