Windows Critical Update

[CjkaceBM]

Who should read this document: Customers who are using Microsoft® Windows®

Impact of vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Recommendation: Systems administrators should apply the update immediately.

Security Update Replacement: None

Caveats: Windows NT 4.0 (Workstation, Server, and Terminal Server Edition) does not install the affected file by default. This file is installed as part of the MS03-041 Windows NT 4.0 security update and other possible non-security-related hotfixes. If the Windows NT 4.0 security update for MS03-041 is not installed, this may not be a required update. To verify if the affected file is installed, search for the file named Msasn1.dll. If this file is present, this security update is required. Windows Update, Software Update Services, and the Microsoft Security Baseline Analyzer will also correctly detect if this update is required.

Affected Components:

Microsoft ASN.1 Library
The software listed above has been tested to determine if the versions are affected. Other versions either no longer include security update support or may not be affected. Please review the Microsoft Support Lifecycle Web site to determine the support lifecycle for your product and version.


Technical Details
A security vulnerability exists in the Microsoft ASN.1 Library that could allow code execution on an affected system. The vulnerability is caused by an unchecked buffer in the Microsoft ASN.1 Library, which could result in a buffer overflow.

An attacker who successfully exploited this buffer overflow vulnerability could execute code with system privileges on an affected system. The attacker could then take any action on the system, including installing programs, viewing data, changing data, deleting data, or creating new accounts with full privileges.

Abstract Syntax Notation 1 (ASN.1) is a data standard that is used by many applications and devices in the technology industry for allowing the normalization and understanding of data across various platforms. More information about ASN.1 can be found in Microsoft Knowledge Base Article 252648.

Mitigating factors:

In the most likely exploitable scenario, an attacker would have to have direct access to the user's network.

Severity Rating:

Microsoft Windows NT 4.0 Critical
Microsoft Windows NT Server 4.0 Terminal Server Edition Critical
Microsoft Windows 2000 Critical
Microsoft Windows XP Critical
Microsoft Windows Server 2003 Critical

The above assessment is based on the types of systems that are affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.

Vulnerability identifier: CAN-2003-0818

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS04-007.asp

 

[Sharma]

You know sometimes i think its times like these i wish i had a *nix system or even a mac.

 

[Kami]

LOL Trust me you don't want a mac, especially a G4 servers. I have nightmares with the ones we have at work..

It's like a woman, now and then it just decides to be a bitch, womans right of course

Add to that the fact that Apple release just as many OS updates as MS and tend to make more bugs with each release - Then come out with a brand new OS and tell you just to buy it - it'll sort your problems.

 

[Hulbur]

Well thanks for the heads up anyways.

But as far as i can tell, as long as you got the (sp1) downloaded, you should be in the clear?

 

[PJS]

if (sizeof(data) > sizeof(buffer)) then error

how hard is it really???

 

[Roo Stercogburn]

The function is easy. Making sure the reference is included at all appropriate points in code that may be tens of thousands of lines long isn't - with modules written by different groups of developers, even if they are using source control things can slip through.

Despite how trendy it is to bash MS and other providers, the coders aren't noobs and developing business level software isn't quite as easy as knowing a couple of lines of code

 

[Athan]

Well thanks for the heads up anyways.

But as far as i can tell, as long as you got the (sp1) downloaded, you should be in the clear?

In a word: no. Now go run IE (shudder, but necessary for this) and Tools > Windows Update. Sheesh you should be doing that at least once a week if you've turned off it checking automatically!

-Ath

 

[Roo Stercogburn]

Yer, from the security bulletins, you need this update even if you've been religious about Windows Updates, whatever version you are running and tbh when I checked my own laptop out (which is always up to date) that critical update was sitting there waiting to be added.

 

[yaruar]

You know sometimes i think its times like these i wish i had a *nix system or even a mac.

Sometimes I wish that the hardware designers of processors and memory architecture made it possible to stop buffer overflows at the hardware level by fencing off memory and not allowing over writes. They are the ones to blame IMO.

 

[Anastasia]

Despite how trendy it is to bash MS and other providers, the coders aren't noobs and developing business level software isn't quite as easy as knowing a couple of lines of code

true

 

[yaruar]

The function is easy. Making sure the reference is included at all appropriate points in code that may be tens of thousands of lines long isn't - with modules written by different groups of developers, even if they are using source control things can slip through.

Despite how trendy it is to bash MS and other providers, the coders aren't noobs and developing business level software isn't quite as easy as knowing a couple of lines of code

indeed and people are soon to forget just how many security holes are patched on a mnothly basis in linux and other puported secure os's

I've said it once and I'll say it again my patched MS servers are a damn sight more secure than the redhat box most n00b linux users have in their homes because they don't think they need to patch, or just don't know where to get the patches from.

 

[Prudil]

indeed and people are soon to forget just how many security holes are patched on a mnothly basis in linux and other puported secure os's

I've said it once and I'll say it again my patched MS servers are a damn sight more secure than the redhat box most n00b linux users have in their homes because they don't think they need to patch, or just don't know where to get the patches from.

Amen

 

[PJS]

The function is easy. Making sure the reference is included at all appropriate points in code that may be tens of thousands of lines long isn't - with modules written by different groups of developers, even if they are using source control things can slip through.

Despite how trendy it is to bash MS and other providers, the coders aren't noobs and developing business level software isn't quite as easy as knowing a couple of lines of code

Yeah, well I am a software engineer and any coder who is responsible for an unchecked buffer overflow is a noob. You put it in when you write the code not as an afterthought. When you create an array that is filled from a source out of your control (ie user input) YOU CHECK THE DAMN INPUT FOR OVERFLOW. Simple as that and a lot easier than rocket science.

 

[Roo Stercogburn]

Can't have worked on anything very complex then

 

[Anastasia]

Yeah, well I am a software engineer and any coder who is responsible for an unchecked buffer overflow is a noob. You put it in when you write the code not as an afterthought. When you create an array that is filled from a source out of your control (ie user input) YOU CHECK THE DAMN INPUT FOR OVERFLOW. Simple as that and a lot easier than rocket science.

Send em your cv then mate, cos I for one am sick to death of skript kiddehs taking advantage of these n00b holes in the OS to prove just how tragically inadequate they are in real life

 

[CjkaceBM]

Yeah, well I am a software engineer and any coder who is responsible for an unchecked buffer overflow is a noob. You put it in when you write the code not as an afterthought. When you create an array that is filled from a source out of your control (ie user input) YOU CHECK THE DAMN INPUT FOR OVERFLOW. Simple as that and a lot easier than rocket science.

LOL All bow to the greatest programmer on Earth.

Better than the makers of -

Windows (any variety)

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-042.asp
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-072.asp
http://www.hot4down.com/20/software_3002-2092-6417879.htm

Solaris

http://www.cert.org/advisories/CA-2002-34.html
http://www.kb.cert.org/vuls/id/484011
http://www.kb.cert.org/vuls/id/596748

Linux

http://securecomputing.stanford.edu/alerts/samba-rollup.html
http://www.cert.org/advisories/CA-2003-25.html
http://www.gentoo.org/security/en/glsa/glsa-200312-02.xml

Isn't Google a wonderful tool?

 

[Roo Stercogburn]

I remember when I was in a previous job, we had a meeting with various departments.

The entire development team was there and they were whining bitterly about the software tools they had to work with. I just looked rather pointedly at the dev manager and said "Yeh, there's nothing worse than a bunch of tools that are no use."

Strangely, it went quiet after that

 

[Oasis]

It's like a woman, now and then it just decides to be a bitch, womans right of course

LMFAO you fucking twat. Sexist and supporter of animal exploitation/cruelty (ur avatar is not funny). Will you ever learn?

 

[PJS]

LOL All bow to the greatest programmer on Earth

I never claimed to be that. But checking what you write into arrays isn't too long is 1st year Computer Science stuff.

When you are writing things like Internet Explorer and Windows Networking code that are vulnerable to hackers not being arsed to check buffer sizes is pretty much criminal negligence and the sheer volume of "unchecked buffer" security patches that have been issued is beyond a joke and still arriving by the day.

:kissit: MS developers.

 

[PJS]

Send em your cv then mate, cos I for one am sick to death of skript kiddehs taking advantage of these n00b holes in the OS to prove just how tragically inadequate they are in real life

nah, wouldn't work for Micro$haft on principle

 

[legis]

:kissit: MS developers.

You can do that to most developers, probably including yourself. Look at the previous and current vulnerability reports out there. You will see that Linux (and especially Debian and Redhat) has far more reports than Windows. Take your head out of your hat and check out reality for a while.

 

[Driwen]

You can do that to most developers, probably including yourself. Look at the previous and current vulnerability reports out there. You will see that Linux (and especially Debian and Redhat) has far more reports than Windows. Take your head out of your hat and check out reality for a while.

but but its far more fun to bash M$ with the complete mass than think

 

[Anastasia]

nah, wouldn't work for Micro$haft on principle

lmao

Irony
:The use of words to express something different from and often opposite to their literal meaning.
:An expression or utterance marked by a deliberate contrast between apparent and intended meaning.
:A literary style employing such contrasts for humorous or rhetorical effect.

 

[SFXman]

Right... I for one will not be taking notice of any vulnerability notices that do not come up in my automatic Windows Update. Especially now that IE has a flaw that allows people to have any website show up as http://www.microsoft.com/
Then again I am not quite sure as to the point of this thread

 

[Chilly]

i took someones advice and got this:
"Windows Update has encountered an error. This may be due to a discrepancy in your computer's time setting."

As a solution: Check your clock is right.

NO SHIT! its right, anyway...

....well it was correct to the neares 75k milliseconds just corrected.


lol oh dear, iv got 18 critical updates to DL :/

 

[CjkaceBM]

Right... I for one will not be taking notice of any vulnerability notices that do not come up in my automatic Windows Update. Especially now that IE has a flaw that allows people to have any website show up as http://www.microsoft.com/
Then again I am not quite sure as to the point of this thread

The point of this thread is that the vulnerability listed is more critical than the one exploited by the Blaster worm (and look at the damage caused).

The problem with using Windows Update is that it wants to install every patch, doesn't really explain what the patch does and in some cases can cause more problems than it fixes (until the patch is patched).

 

[PJS]

The point of this thread is that the vulnerability listed is more critical than the one exploited by the Blaster worm (and look at the damage caused).

The problem with using Windows Update is that it wants to install every patch, doesn't really explain what the patch does and in some cases can cause more problems than it fixes (until the patch is patched).

And while were on the subject of shit coding. How about releasing a critical security patch on Windows update that DOESNT FIX WHAT IT SAYS. How about then releasing a 2nd patch THAT STILL DOESNT FIX IT. How about having to need THREE ATTEMPTS to get a crucial fix correct.
How about releasing a patch to fix one security issue that INTRODUCES A NEW EVEN WORSE security hole?

 

[PJS]

You can do that to most developers, probably including yourself. Look at the previous and current vulnerability reports out there. You will see that Linux (and especially Debian and Redhat) has far more reports than Windows. Take your head out of your hat and check out reality for a while.

http://www.nizkor.org/features/fallacies/appeal-to-common-practice.html

The argument that all OS developers are shit so therefore it's acceptable is a fallacy. It's not.

 

[Nichneven]

Trust me you don't want a mac, especially a G4 servers. I have nightmares with the ones we have at work..

It's like a woman, now and then it just decides to be a bitch, womans right of course

lol

Can't help laughing... I swear my husband once made the same comparrison

*wags finger*

 

[legis]

And while were on the subject of shit coding. How about releasing a critical security patch on Windows update that DOESNT FIX WHAT IT SAYS. How about then releasing a 2nd patch THAT STILL DOESNT FIX IT. How about having to need THREE ATTEMPTS to get a crucial fix correct.
How about releasing a patch to fix one security issue that INTRODUCES A NEW EVEN WORSE security hole?

I am starting to wonder how many times I will need to repeat myself to ask you to visit reality. This will be a fun count.

I agree on a whole that ideally this would never have to happen. It does though, and still will. We are humans, we are imperfect. That's life.