Bekijk Volledige Versie : RE: ISS Security Rip: Microsoft ASN.1 (Half a sploit)
"Due to the nature of this vulnerability, reliable and successful remote
exploitation is considered difficult."
funny little men. there already a half working exploit for ASN.
http://linuxfromscratch.org/~devine/MS04-007-dos.c
-----Original Message-----
From: X-Force [mailto:xforce@iss.net]
Sent: Wednesday, February 11, 2004 9:55 AM
To: bugtraq@securityfocus.com
Subject: ISS Security Brief: Microsoft ASN.1 Integer Manipulation Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Internet Security Systems Security Brief February 11, 2004
Microsoft ASN.1 Integer Manipulation Vulnerabilities
Synopsis:
Microsoft has release Security Bulletin MS04-007 to address vulnerabilities
in the ASN.1 parsing component of the Windows Operating Systems. This
component is used by several applications for transmission of data across
the network. Some examples of applications which make use of ASN.1 include
Internet Explorer and IIS for certificate parsing, NTLMv2 authentication,
Kerberos authentication, ISAKMP, LDAP and Exchange.
Impact:
The vulnerability could be exploited by remote attackers to cause a Denial
of Service (DoS) or potentially gain access to a vulnerable machine with
the privileges of the services being exploited. This vulnerability may
be exploited in many default configurations if vulnerable services are
remotely accessible.
There are currently no known exploits in the wild for this issue. Due
to the nature of this vulnerability, reliable and successful remote exploitation
is considered difficult
Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2
Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434
Promote security and make money with the Hushmail Affiliate Program:
https://www.hushmail.com/about.php?subloc=affiliate&l=427
K-OTiK Security
16/02/04, 18:25
In-Reply-To: <200402132315.i1DNFYAa067379@mailserver1.hushmail.c om>
Note that the SANS said "This Exploit appears to work only against Windows 2000 Professional..."
We say : works against Windows 2000 & Windows XP
other versions ? 2k3 ?
References
http://www.k-otik.com/exploits/02.14.MS04-007-dos.c.php
http://isc.sans.org/diary.html
Regards.
K-OTik Staff
http://www.k-otik.com
Valdis.Kletnieks@vt.edu
17/02/04, 19:55
--==_Exmh_847137258P
Content-Type: text/plain; charset=us-ascii
On Fri, 13 Feb 2004 15:15:34 PST, kradhatman@hushmail.com said:
> "Due to the nature of this vulnerability, reliable and successful remote
> exploitation is considered difficult."
>
> funny little men. there already a half working exploit for ASN.
OK.. So it's a bit tougher to exploit than 'rlogin -froot'. ;)
Though I remember encountering a few who had problems with THAT one. ;)
--==_Exmh_847137258P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001
iD8DBQFAL/pecC3lWbTT17ARAgF6AJ975KSgN5o8wtVmWA05lpAP2l/apgCgkn8H
WdP+4Jl8aJUvJmLbeclZx8A=
=l6BA
-----END PGP SIGNATURE-----
--==_Exmh_847137258P--
In-Reply-To: <20040215130958.17364.qmail@www.securityfocus.com>
FYI...
The DoS exploit for ms04-007 works successfully on WS03 /W2K3 and W2K AdvServer with SP3.
WebHead
>Received: (qmail 15182 invoked from network); 16 Feb 2004 16:42:00 -0000
>Received: from outgoing3.securityfocus.com (205.206.231.27)
> by mail.securityfocus.com with SMTP; 16 Feb 2004 16:42:00 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing3.securityfocus.com (Postfix) with QMQP
> id 7F664A30D6; Mon, 16 Feb 2004 11:09:14 -0700 (MST)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 20023 invoked from network); 15 Feb 2004 07:01:17 -0000
>Date: 15 Feb 2004 13:09:58 -0000
>Message-ID: <20040215130958.17364.qmail@www.securityfocus.com>
>Content-Type: text/plain
>Content-Disposition: inline
>Content-Transfer-Encoding: binary
>MIME-Version: 1.0
>X-Mailer: MIME-tools 5.411 (Entity 5.404)
>From: K-OTiK Security <Special-Alerts@k-otik.com>
>To: bugtraq@securityfocus.com
>Subject: Re: Microsoft ASN.1 (Half a sploit)
>
>In-Reply-To: <200402132315.i1DNFYAa067379@mailserver1.hushmail.c om>
>
>Note that the SANS said "This Exploit appears to work only against Windows 2000 Professional..."
>
>We say : works against Windows 2000 & Windows XP
>
>other versions ? 2k3 ?
>
>References
>http://www.k-otik.com/exploits/02.14.MS04-007-dos.c.php
>http://isc.sans.org/diary.html
>
>Regards.
>K-OTik Staff
>http://www.k-otik.com
>
>
>
Joshua Levitsky
20/02/04, 01:25
Windows 98 SE;
Starting nmap 3.48 ( http://www.insecure.org/nmap/ ) at 2004-02-18 12:52 EST
PORT STATE SERVICE
139/tcp open netbios-ssn
427/tcp open svrloc
[root@dsg root]# ./MS04-007-dos 10.187.5.57 139
[root@dsg root]# nmap 10.187.5.57
Starting nmap 3.48 ( http://www.insecure.org/nmap/ ) at 2004-02-18 12:52 EST
PORT STATE SERVICE
139/tcp open netbios-ssn
--
Joshua Levitsky, MCSE, CISSP
System Engineer
http://www.foist.org/
[5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1]
----- Original Message -----
From: "WebHead" <webheadport80@yahoo.com>
To: <bugtraq@securityfocus.com>
Sent: Tuesday, February 17, 2004 12:38 AM
Subject: Re: Microsoft ASN.1 (Half a sploit)
> In-Reply-To: <20040215130958.17364.qmail@www.securityfocus.com>
>
> FYI...
>
> The DoS exploit for ms04-007 works successfully on WS03 /W2K3 and W2K
AdvServer with SP3.
>
> WebHead
>
>
>
> >Received: (qmail 15182 invoked from network); 16 Feb 2004 16:42:00 -0000
> >Received: from outgoing3.securityfocus.com (205.206.231.27)
> > by mail.securityfocus.com with SMTP; 16 Feb 2004 16:42:00 -0000
> >Received: from lists2.securityfocus.com (lists2.securityfocus.com
[205.206.231.20])
> > by outgoing3.securityfocus.com (Postfix) with QMQP
> > id 7F664A30D6; Mon, 16 Feb 2004 11:09:14 -0700 (MST)
> >Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
> >Precedence: bulk
> >List-Id: <bugtraq.list-id.securityfocus.com>
> >List-Post: <mailto:bugtraq@securityfocus.com>
> >List-Help: <mailto:bugtraq-help@securityfocus.com>
> >List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
> >List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
> >Delivered-To: mailing list bugtraq@securityfocus.com
> >Delivered-To: moderator for bugtraq@securityfocus.com
> >Received: (qmail 20023 invoked from network); 15 Feb 2004 07:01:17 -0000
> >Date: 15 Feb 2004 13:09:58 -0000
> >Message-ID: <20040215130958.17364.qmail@www.securityfocus.com>
> >Content-Type: text/plain
> >Content-Disposition: inline
> >Content-Transfer-Encoding: binary
> >MIME-Version: 1.0
> >X-Mailer: MIME-tools 5.411 (Entity 5.404)
> >From: K-OTiK Security <Special-Alerts@k-otik.com>
> >To: bugtraq@securityfocus.com
> >Subject: Re: Microsoft ASN.1 (Half a sploit)
> >
> >In-Reply-To: <200402132315.i1DNFYAa067379@mailserver1.hushmail.c om>
> >
> >Note that the SANS said "This Exploit appears to work only against
Windows 2000 Professional..."
> >
> >We say : works against Windows 2000 & Windows XP
> >
> >other versions ? 2k3 ?
> >
> >References
> >http://www.k-otik.com/exploits/02.14.MS04-007-dos.c.php
> >http://isc.sans.org/diary.html
> >
> >Regards.
> >K-OTik Staff
> >http://www.k-otik.com
> >
> >
> >
>