[33721] in bugtraq
RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption
daemon@ATHENA.MIT.EDU (Bill Gallagher)
Mon Feb 16 01:58:13 2004
Message-ID: <3890369415CFD61194760008C79FB1FC089BA2@altair.rockgrove>
From: Bill Gallagher <Bill.Gallagher@augharue.com>
To: "'Tina Bird'" <tbird@precision-guesswork.com>
Cc: BUGTRAQ@securityfocus.com
Date: Thu, 12 Feb 2004 09:12:37 -0000
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
...
> In order to trigger the ASN.1 vulnerabilities an attacker has
> to be able
> to get the target machine to invoke its BER decoding capabilities.
I have read a good number of the posts here regarding this vulnerability and
have seen references to NTLM etc. as a pathway for attack. What about SNMP?,
it certainly uses ASN.1. Does MS's SNMP stack not use this DLL? - Must
check.
> I
> certainly don't know the details -- maybe someone here does?
> -- but it's
> gotta be a little difficult to send a random network packet to get a
> desktop machine (that is, not a domain controller or an AD server or
> something) and get it to invoke MSASN1.
>
> I can imagine lots of attacks that require user intervention
> to hit this
> one (like opening a hostile SSL-based web site) -- but can this be
> triggered without user intervention?
>
> thanks for more info -- tbird
>
Like the others, SNMP should never pass the perimeter defences, but we are
talking about the same internet that got hit by blaster, SQL-Slammer etc.
I'm still occasionally finding it difficult to get some admins to operate a
'default deny' stance on inbound ports, let alone outbound.
