Signature Detail

HTTP: ASN.1 Stack-Based Buffer Overflow

This signature detects attempts to exploit a known vulnerability against the Microsoft ASN.1 library, which is susceptible to multiple stack-based buffer overflow vulnerabilities. A successful attack can allow an attacker to execute arbitrary code leading to unauthorized access. The issues are identified in ASN1BERDecDouble and ASN1PERDecDouble functions.

Extended Description

Heap-based buffer overflow in the BERDecBitString function in Microsoft ASN.1 library (MSASN1.DLL) allows remote attackers to execute arbitrary code via nested constructed bit strings, which leads to a realloc of a non-null pointer and causes the function to overwrite previously freed memory, as demonstrated using a SPNEGO token with a constructed bit string during HTTP authentication, and a different vulnerability than CVE-2003-0818. NOTE: the researcher has claimed that MS:MS04-007 fixes this issue.

Affected Products

• Microsoft windows_2000 (sp2)
• Microsoft windows_2000 (sp3)
• Microsoft windows_2000 (sp4:)
• Microsoft windows_2000 (sp4)
• Microsoft windows_2000 (sp4::fr)
• Microsoft windows_2003_server 64-bit
• Microsoft windows_2003_server r2
• Microsoft windows_nt 4.0 (sp6)
• Microsoft windows_nt 4.0 (sp6a)
• Microsoft windows_nt 4.0 (sp6a:server)
• Microsoft windows_nt 4.0 (sp6a:workstation)
• Microsoft windows_nt 4.0 (sp6:terminal_server)
• Microsoft windows_xp (:64-bit)
• Microsoft windows_xp (gold)
• Microsoft windows_xp (sp1)
• Microsoft windows_xp (sp1:64-bit)
• Microsoft windows_xp (sp1:tablet_pc)

References

• BugTraq: 9633
• CVE: CVE-2005-1935
• URL: http://www.us-cert.gov/cas/techalerts/TA04-041A.html
• URL: http://www.microsoft.com/technet/security/bulletin/MS04-007.mspx
• URL: http://www.kb.cert.org/vuls/id/216324