OSVDB ID: 5261

Title: Microsoft Windows ASN.1 Double Free Code Execution

Info

Disclosure
Apr 13, 2004

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 Microsoft's ASN.1 implementation contains a flaw that may allow a malicious user to cause denial-of-service conditions or possibly execute arbitrary code. The issue is triggered when a specially crafted authentication request is sent to the ASN.1 parser, causing it to free memory that has already been freed. It is possible that the flaw may allow memory corruption, denial of service, or the execution of arbitrary code, resulting in a loss of confidentiality, integrity, and/or availability.

Classification

 Location: Local Access Required, Remote / Network Access
Attack Type: Cryptographic, Denial of Service, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity, Loss of Availability
Exploit: Exploit Rumored
Disclosure: OSVDB Verified

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Microsoft Corporation

Windows

 98
98 SE
ME
2000 Advanced Server
2000 Professional
2000 Datacenter Server
2000 Server
NT 4.0 Workstation
NT 4.0 Server
NT 4.0 Server Terminal Server Edition
NT 4.0 Server Enterprise Edition
XP Media Center Edition
XP Professional
XP 64-bit Edition Version 2003
2003 Server
XP 64-bit Edition
XP Home Edition

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/5261