Flow My Thoughts, The IT Professor Said

ASN-ine

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci949830,00.html

The major flap about the ASN.1 vulnerability issue in Microsoft Windows of course represents a serious core issue [not least the fact that the company 'sat on' the problem for 6 months after being notified]. But it is just as important to understand how fundamental this flaw is -- ASN.1 is the specification which drives the data definition for all networked elements, and is at the heart of SNMP.

Also important is understanding the nature of the flaw -- it was a buffer overflow [and where have we heard that before?], allowing the attacker to take over and run the affected machine remotely. The fact that the flaw was located in the parser library for ASN.1 just makes this worse, since this library is used in cryptographic and authentication routines like Kerberos. The irony of this, of course, is that the exploit just affects the 32-bit and 64-bit versions of the Windows OS, which are supposed to be the most secure.

Now a patch is available at:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS04-007.asp

but this should not really help us sleep at night. Because ASN.1 is so fundamental to network operations, we have to ask ourselves: are the ASN.1 libraries used by other operating systems really safe?

Posted by jho at February 20, 2004 08:43 AM