Vulnerability CVE-2003-0818 - CERT Civis.Net

Vulnerability Name:

CVE-2003-0818 (CCN-15039)

Assigned:

2004-02-10

Published:

2004-02-10

Updated:

2019-04-30

Summary:

Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2003-0818

Source: BUGTRAQ
Type: UNKNOWN
20040210 EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption

Source: BUGTRAQ
Type: UNKNOWN
20040210 EEYE: Microsoft ASN.1 Library Bit String Heap Corruption

Source: NTBUGTRAQ
Type: UNKNOWN
20040210 EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption

Source: NTBUGTRAQ
Type: UNKNOWN
20040210 EEYE: Microsoft ASN.1 Library Bit String Heap Corruption

Source: CCN
Type: US-CERT VU#216324
Microsoft ASN.1 Library improperly decodes malformed ASN.1 length values

Source: CERT-VN
Type: Third Party Advisory, US Government Resource
VU#216324

Source: CCN
Type: US-CERT VU#583108
Microsoft ASN.1 Library improperly decodes constructed bit strings

Source: CERT-VN
Type: US Government Resource
VU#583108

Source: CCN
Type: Microsoft Security Bulletin MS04-007
ASN.1 Vulnerability that Could Allow Code Execution (828028)

Source: CCN
Type: Microsoft Security Bulletin MS04-011
Security Update for Microsoft Windows (835732)

Source: CCN
Type: UNIRAS (UK Govt CERT) ALERT - 04/04 dated 11.02.04 Time: 11:50
NISCC Assessment of Microsoft ASN.1 Library Vulnerabilities

Source: CCN
Type: UNIRAS (UK Govt CERT) Briefing Notice - 75/04 dated 14.02.04 Time: 19:50
Exploit code for Microsoft Windows ASN.1 Vulnerabilities

Source: CCN
Type: BID-13300
Microsoft Windows ASN.1 Library Bit String Processing Variant Heap Corruption Vulnerability

Source: CCN
Type: BID-9633
Microsoft ASN.1 Library Length Integer Mishandling Memory Corruption Vulnerability

Source: CCN
Type: BID-9635
Microsoft Windows ASN.1 Library Bit String Processing Integer Handling Vulnerability

Source: CCN
Type: BID-9660
Microsoft IIS Unspecified Remote Denial Of Service Vulnerability

Source: CCN
Type: BID-9743
Microsoft ASN.1 Library Multiple Stack-Based Buffer Overflow Vulnerabilities

Source: CCN
Type: Technical Cyber Security Alert TA04-041A
Multiple Vulnerabilities in Microsoft ASN.1 Library

Source: CERT
Type: US Government Resource
TA04-041A

Source: CCN
Type: Internet Security Systems Security Alert, February 11, 2004
Microsoft ASN.1 Integer Manipulation Vulnerabilities

Source: MS
Type: UNKNOWN
MS04-007

Source: XF
Type: UNKNOWN
win-asn1-library-bo(15039)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:653

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:796

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:797

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:799

Vulnerable Configuration:

Configuration 1:

cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:enterprise:*:64-bit:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:enterprise_64-bit:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:r2:*:64-bit:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:r2:*:datacenter_64-bit:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:standard:*:64-bit:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:web:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:*:server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:*:terminal_server:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:*:workstation:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:sp1:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp1:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp1:*:*:workstation:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp2:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp2:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp2:*:*:workstation:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp3:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp3:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp3:*:*:workstation:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp4:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp4:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp4:*:*:workstation:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp5:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp5:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp5:*:*:workstation:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:terminal_server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:workstation:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6a:*:*:server:*:x86:*

OR cpe:/o:microsoft:windows_nt:4.0:sp6a:*:*:workstation:*:x86:*

OR cpe:/o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:*:home:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*

Configuration CCN 1:

cpe:/o:microsoft:windows:xp:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:*:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows:2003_server:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp1:*:*:*:*:x64:*

AND

cpe:/o:microsoft:windows:2003_server:*:x64:*:*:*:*:*

Denotes that component is vulnerable

Vulnerability Name:

CVE-2003-0818 (CCN-27832)

Assigned:

2004-02-10

Published:

2004-02-10

Updated:

2019-04-30

Summary:

Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2003-0818

Source: CCN
Type: US-CERT VU#216324
Microsoft ASN.1 Library improperly decodes malformed ASN.1 length values

Source: CCN
Type: US-CERT VU#583108
Microsoft ASN.1 Library improperly decodes constructed bit strings

Source: CCN
Type: Microsoft Security Bulletin MS04-007
ASN.1 Vulnerability that Could Allow Code Execution (828028)

Source: CCN
Type: Microsoft Security Bulletin MS04-011
Security Update for Microsoft Windows (835732)

Source: CCN
Type: UNIRAS (UK Govt CERT) ALERT - 04/04 dated 11.02.04 Time: 11:50
NISCC Assessment of Microsoft ASN.1 Library Vulnerabilities

Source: CCN
Type: UNIRAS (UK Govt CERT) Briefing Notice - 75/04 dated 14.02.04 Time: 19:50
Exploit code for Microsoft Windows ASN.1 Vulnerabilities

Source: CCN
Type: BID-13300
Microsoft Windows ASN.1 Library Bit String Processing Variant Heap Corruption Vulnerability

Source: CCN
Type: BID-9633
Microsoft ASN.1 Library Length Integer Mishandling Memory Corruption Vulnerability

Source: CCN
Type: BID-9635
Microsoft Windows ASN.1 Library Bit String Processing Integer Handling Vulnerability

Source: CCN
Type: BID-9743
Microsoft ASN.1 Library Multiple Stack-Based Buffer Overflow Vulnerabilities

Source: CCN
Type: Technical Cyber Security Alert TA04-041A
Multiple Vulnerabilities in Microsoft ASN.1 Library

Source: CCN
Type: Internet Security Systems Security Alert, February 11, 2004
Microsoft ASN.1 Integer Manipulation Vulnerabilities

Source: XF
Type: UNKNOWN
win-asn1-http-bo(27832)

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:797	V	Windows XP ASN.1 Library Integer Overflow Vulnerabilities	2011-05-16
oval:org.mitre.oval:def:796	V	Windows NT ASN.1 Library Integer Overflow Vulnerabilities	2008-03-24
oval:org.mitre.oval:def:653	V	Windows 2000 ASN.1 Library Integer Overflow Vulnerabilities	2004-03-25
oval:org.mitre.oval:def:799	V	Windows Server 2003 ASN.1 Library Integer Overflow Vulnerabilities	2004-03-25