HTTP: IIS Malformed ASN.1 Bit String

This signature detects attempts to exploit vulnerabilities in Microsoft Internet Information Server (IIS). Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000; and XP, contains multiple integer overflows are vulnerable. Attackers can use ASN.1 encoding to overwrite heap data and remotely execute arbitrary code on the target system.

Extended Description

Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.

Affected Products

Microsoft windows_2000

References

BugTraq: 9633

CVE: CVE-2003-0818

URL: http://research.eeye.com/html/advisories/published/AD20040210-2.html http://www.microsoft.com/technet/security/bulletin/MS04-007.asp

Short Name

HTTP:IIS:ASN.1-BIT-STRING

Severity

Major

Recommended

False

Recommended Action

None

HTTP: IIS Malformed ASN.1 Bit String

Extended Description

Affected Products

References

Found a potential security threat?