Public exploits available
On this page
A security vulnerability exists in the Microsoft ASN.1 Library that could allow code execution on an affected system. The vulnerability is caused by an unchecked buffer in the Microsoft ASN.1 Library, which could result in a buffer overflow.
If successfully exploited, the attacker could be able to take any action on the system, including installing programs, viewing data, changing data, deleting data, or creating new accounts with full privileges.
Technical details (analysis)
Abstract Syntax Notation 1 (ASN.1) is a data standard that is used by many applications and devices in the technology industry for allowing the normalization and understanding of data across various platforms. The vulnerability is caused by an unchecked buffer in the Microsoft ASN.1 Library. If exploited, an attacker could gain system privileges on an affected system. Because ASN.1 is a standard for many applications and devices, there are many potential attack vectors. To successfully exploit this vulnerability, an attacker must force a computer to decode malformed ASN.1 data. For example, when using authentication protocols based on ASN.1 it could be possible to construct a malformed authentication request that could expose this vulnerability.
Microsoft Windows NT Workstation 4.0 Service Pack 6a.
Microsoft Windows NT Server 4.0 Service Pack 6a.
Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6.
Microsoft Windows 2000 Service Pack 2, Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4.
Microsoft Windows XP, Microsoft Windows XP Service Pack 1.
Microsoft Windows XP 64-Bit Edition, Microsoft Windows XP 64-Bit Edition Service Pack 1.
Microsoft Windows XP 64-Bit Edition Version 2003, Microsoft Windows XP 64-Bit Edition Version 2003 Service Pack 1.
Microsoft Windows Server 2003.
Microsoft Windows Server 2003 64-Bit Edition.
All applications not on the affected list.
Release Date: 2003-05-07T00:00:00
Known false positives
No known false positives at this time.
There are no known workarounds.