-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

     ESB-2004.0113 -- US-CERT Technical Cyber Security Alert TA04-041A
            Multiple Vulnerabilities in Microsoft ASN.1 Library
                             11 February 2004

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Microsoft Windows Server 2003
                        Microsoft Windows XP
                        Microsoft Windows 2000
                        Microsoft Windows NT 4.0 Terminal Services
                        Microsoft Windows NT 4.0
Publisher:              US-CERT
Operating System:       Windows
Impact:                 Execute Arbitrary Code/Commands
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Multiple Vulnerabilities in Microsoft ASN.1 Library

   Original issue date: February 10, 2004
   Last revised: --
   Source: US-CERT

   A complete revision history is at the end of this document.

Systems Affected

     * Microsoft Windows NT 4.0
     * Microsoft Windows NT 4.0 TSE
     * Microsoft Windows 2000
     * Microsoft Windows XP
     * Microsoft Windows Server 2003

Overview

   Multiple integer overflow vulnerabilities in the Microsoft Windows
   ASN.1 parser library could allow an unauthenticated, remote attacker
   to execute arbitrary code with SYSTEM privileges.

Description

   Microsoft Security Bulletin MS04-007 announces a patch for multiple
   vulnerabilities in the Microsoft Windows ASN.1 library
   (msasn1.dll).  According to information from eEye Digital Security,
   the vulnerabilities involve integer overflows and other flaws in
   integer arithmetic. The latest version of this document can be
   found at

   <http://www.us-cert.gov/cas/techalerts/TA04-041A.html>

   Additional information is available in two vulnerability notes:

   VU#216324 - Microsoft ASN.1 Library improperly decodes malformed ASN.1
   length values
   (Other resources: AD20040210, MS04-007, CAN-2003-0818) 

   VU#583108 - Microsoft ASN.1 Library improperly decodes constructed bit
   strings
   (Other resources: AD20040210-2, MS04-007, CAN-2003-0818) 

   eEye has published two detailed advisories on these issues: AD20040210
   and AD20040210-2.

   Any application that loads the ASN.1 library could serve as an attack
   vector. In particular, ASN.1 is used by a number of cryptographic and
   authentication services such as digital certificates (x.509),
   Kerberos, NTLMv2, SSL,and TLS. Both client and server systems are
   affected. The Local Security Authority Subsystem (lsass.exe) and a
   component of the CryptoAPI (crypt32.dll) use the vulnerable ASN.1
   library.

Impact

   An unauthenticated, remote attacker could execute arbitrary code with
   the privileges of the process using the ASN.1 library. In the case of
   most server and authentication applications, an attacker could gain
   SYSTEM privileges.

Solution

Apply a patch

   Apply the appropriate patch as specified by Microsoft Security
   Bulletin MS04-007.

Vendor Information

   This appendix contains information provided by vendors. When vendors
   report new information, this section is updated and the changes are
   noted in the revision history. If a vendor is not listed below, we
   have not received their comments.

Microsoft

     Please see Microsoft Security Bulletin MS04-007.

References

     * Vulnerability Note VU#216324 -
       <http://www.kb.cert.org/vuls/id/216324>
     * Vulnerability Note VU#583108 -
       <http://www.kb.cert.org/vuls/id/583108>
     * eEye Digital Security Advisory AD20040210 -
       <http://www.eeye.com/html/Research/Advisories/AD20040210.html>
     * eEye Digital Security Advisory AD20040210-2 -
       <http://www.eeye.com/html/Research/Advisories/AD20040210-2.html>
     * Microsoft Security Bulletin MS04-007 -
       <http://microsoft.com/technet/security/bulletin/MS04-007.asp>
     * Microsoft Knowledge Base Article 252648 -
       <http://support.microsoft.com/default.aspx?scid=252648>
     _________________________________________________________________

   These vulnerabilities were researched and reported by eEye Digital
   Security. Information from eEye and Microsoft was used in this
   document.
     _________________________________________________________________

   Feedback can be directed to the author, Art Manion.

   Copyright 2004 Carnegie Mellon University.

   Revision History

   February 10, 2004: Initial release

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAKVrdXlvNRxAkFWARAuOvAJwL2gJJPBRdrtZ0Le4yyLQLu7CHewCgvaCW
5hU8LQ/oOC4sI8PpnkppCyg=
=Oe/N
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQClneih9+71yA2DNAQF7QwP9H3FjLVlzeQkN1mCzPxWUaOzRc9jX67gi
H1CE8jD6S9/k3ESlJcDihJCIWFSLCygTgvtzNDixXusvMXun5QYbaRRRyr0FCdL/
gB7798Ld2cbH1pBJx/Mkp9S/rPRzTUXDk/r+SDajpC7216R1oC7qkLhXV+wQ30VM
Ma6SbVYkG5s=
=6ESA
-----END PGP SIGNATURE-----