Signature Detail
Short Name |
NETBIOS:OVERFLOW:ASN-1-BER |
|---|---|
Severity |
Critical |
Recommended |
No |
Recommended Action |
Drop |
Category |
NETBIOS |
Keywords |
ASN.1 Malformed BER Encoding Overflow |
Release Date |
2004/02/15 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
NETBIOS: ASN.1 Malformed BER Encoding Overflow
This signature detects a malformed BER-encoded ASN.1 region in a NTLM session request message. A known vulnerability exists in certain versions of Microsoft Windows that can result in a denial of service (DoS) or remote code execution as SYSTEM.
Extended Description
Microsoft ASN.1 handling library has been reported prone to an integer overflow vulnerability that may result in arbitrary heap-based memory corruption. The issue presents itself in the ASN.1 BER decoding/encoding routines. Exploitation of this issue will result in the corruption of heap based management structures, and may ultimately be leveraged by an attacker to have arbitrary code executed in the context of the affected process. This vulnerability is exposed in a number of security related operating system components, including Kerberos (via UDP port 88), Microsoft IIS with SSL support enabled and NTLMv2 authentication (via TCP ports 135, 139 and 445). Other components may also be affected, though a comprehensive list is not available at this time. It should be noted that because ASN.1 data will likely be encoded, for example Kerberos, SSL, IPSec or Base64 encoded, the malicious integer values may be obfuscated and as a result not easily detectable.
Affected Products
- Adobe Acrobat 5.0.0
- Adobe Acrobat 5.0.5
- Adobe Acrobat 6.0.0
- Altova xmlspy Enterprise Edition 2004
- Altova xmlspy Enterprise Edition 2004 R2
- Altova xmlspy Home Edition 2004
- Altova xmlspy Home Edition 2004 R2
- Altova xmlspy Professional Edition 2004
- Altova xmlspy Professional Edition 2004 R2
- AOL Instant Messenger 5.0.2938
- AOL Instant Messenger 5.1.3036
- AOL Instant Messenger 5.2.3292
- AOL Instant Messenger 5.5.3415 Beta
- Intuit Quicken 2003
- Intuit TurboTax 2003
- JASC Software PaintShop Pro 5.0.0
- JASC Software PaintShop Pro 5.0.0 1
- JASC Software PaintShop Pro 5.0.0 3
- JASC Software PaintShop Pro 6.0.0
- JASC Software PaintShop Pro 6.0.0 1
- JASC Software PaintShop Pro 6.0.0 2
- JASC Software PaintShop Pro 7.0.0
- JASC Software PaintShop Pro 7.0.0 1
- JASC Software PaintShop Pro 7.0.0 2
- JASC Software PaintShop Pro 7.0.0 4
- JASC Software PaintShop Pro 8.0.0 0
- JASC Software PaintShop Pro 8.0.0 1
- JASC Software PaintShop Pro 8.10.0
- Microsoft Windows 2000 Advanced Server SP1
- Microsoft Windows 2000 Advanced Server SP2
- Microsoft Windows 2000 Advanced Server SP3
- Microsoft Windows 2000 Advanced Server SP4
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Professional SP3
- Microsoft Windows 2000 Professional SP4
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Server SP1
- Microsoft Windows 2000 Server SP2
- Microsoft Windows 2000 Server SP3
- Microsoft Windows 2000 Server SP4
- Microsoft Windows 2000 Server
- Microsoft Windows 98
- Microsoft Windows 98SE
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Server 4.0 SP1
- Microsoft Windows NT Server 4.0 SP2
- Microsoft Windows NT Server 4.0 SP3
- Microsoft Windows NT Server 4.0 SP4
- Microsoft Windows NT Server 4.0 SP5
- Microsoft Windows NT Server 4.0 SP6
- Microsoft Windows NT Server 4.0 SP6a
- Microsoft Windows NT Terminal Server 4.0
- Microsoft Windows NT Terminal Server 4.0 SP1
- Microsoft Windows NT Terminal Server 4.0 SP2
- Microsoft Windows NT Terminal Server 4.0 SP3
- Microsoft Windows NT Terminal Server 4.0 SP4
- Microsoft Windows NT Terminal Server 4.0 SP5
- Microsoft Windows NT Terminal Server 4.0 SP6
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0 SP1
- Microsoft Windows NT Workstation 4.0 SP2
- Microsoft Windows NT Workstation 4.0 SP3
- Microsoft Windows NT Workstation 4.0 SP4
- Microsoft Windows NT Workstation 4.0 SP5
- Microsoft Windows NT Workstation 4.0 SP6
- Microsoft Windows NT Workstation 4.0 SP6a
- Microsoft Windows Server 2003 Datacenter Edition
- Microsoft Windows Server 2003 Datacenter Edition Itanium
- Microsoft Windows Server 2003 Enterprise Edition
- Microsoft Windows Server 2003 Enterprise Edition Itanium
- Microsoft Windows Server 2003 Standard Edition
- Microsoft Windows Server 2003 Web Edition
- Microsoft Windows XP 64-bit Edition SP1
- Microsoft Windows XP 64-bit Edition
- Microsoft Windows XP 64-bit Edition Version 2003 SP1
- Microsoft Windows XP 64-bit Edition Version 2003
- Microsoft Windows XP Home SP1
- Microsoft Windows XP Home
- Microsoft Windows XP Professional SP1
- Microsoft Windows XP Professional
- Musicmatch Inc. Musicmatch Jukebox 8.0.0
- Musicmatch Inc. Musicmatch Jukebox 8.1.0
- Musicmatch Inc. Musicmatch Jukebox 8.2.0
- VanDyke SecureCRT 4.0.1
- VanDyke SecureCRT 4.0.2
- VanDyke SecureCRT 4.0.3
- VanDyke SecureCRT 4.0.4
- VanDyke SecureCRT 4.0.5
- Yahoo! Messenger 5.5.0
- Yahoo! Messenger 5.5.0 .1249
- Yahoo! Messenger 5.6.0
- Yahoo! Messenger 5.6.0 .0.1347
- Yahoo! Messenger 5.6.0 .0.1351
- Yahoo! Messenger 5.6.0 .0.1355
- Yahoo! Messenger 5.6.0 .0.1356
- Yahoo! Messenger 5.6.0 .0.1358
References