TechNet Home > TechNet Security > Bulletins

Microsoft Security Bulletin MS04-007

ASN.1 Vulnerability Could Allow Code Execution (828028)

Issued: February 10, 2004

Updated: June 9, 2004

Version Number: 1.1

Summary

Who should read this document:
Customers who are using Microsoft® Windows®

Impact of vulnerability:
Remote Code Execution

Maximum Severity Rating:
Critical

Recommendation:
Systems administrators should apply the update immediately.

Security Update Replacement:
None

Caveats:
Windows NT 4.0 (Workstation, Server, and Terminal Server Edition) does not install the affected file by default. This file is installed as part of the MS03-041 Windows NT 4.0 security update and other possible non-security-related hotfixes. If the Windows NT 4.0 security update for MS03-041 is not installed, this may not be a required update. To verify if the affected file is installed, search for the file named Msasn1.dll. If this file is present, this security update is required. Windows Update, Software Update Services, and the Microsoft Security Baseline Analyzer will also correctly detect if this update is required.

Tested Software and Security Update Download Locations:

Affected Software:

•	Microsoft Windows NT® Workstation 4.0 Service Pack 6a - Download the update.
•	Microsoft Windows NT Server 4.0 Service Pack 6a - Download the update.
•	Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6 - Download the update.
•	Microsoft Windows 2000 Service Pack 2, Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4 - Download the update.
•	Microsoft Windows XP, Microsoft Windows XP Service Pack 1 - Download the update.
•	Microsoft Windows XP 64-Bit Edition, Microsoft Windows XP 64-Bit Edition Service Pack 1 - Download the update.
•	Microsoft Windows XP 64-Bit Edition Version 2003, Microsoft Windows XP 64-Bit Edition Version 2003 Service Pack 1 - Download the update.
•	Microsoft Windows Server™ 2003 - Download the update.
•	Microsoft Windows Server 2003 64-Bit Edition - Download the update.

Tested Microsoft Windows Components:

Affected Components:

•	Microsoft ASN.1 Library

The software listed above has been tested to determine if the versions are affected. Other versions either no longer include security update support or may not be affected. Please review the Microsoft Support Lifecycle Web site to determine the support lifecycle for your product and version.

Top of section

General Information

Technical Details

A security vulnerability exists in the Microsoft ASN.1 Library that could allow code execution on an affected system. The vulnerability is caused by an unchecked buffer in the Microsoft ASN.1 Library, which could result in a buffer overflow.

An attacker who successfully exploited this buffer overflow vulnerability could execute code with system privileges on an affected system. The attacker could then take any action on the system, including installing programs, viewing data, changing data, deleting data, or creating new accounts with full privileges.

Abstract Syntax Notation 1 (ASN.1) is a data standard that is used by many applications and devices in the technology industry for allowing the normalization and understanding of data across various platforms. More information about ASN.1 can be found in Microsoft Knowledge Base Article 252648.

Mitigating factors:

In the most likely exploitable scenario, an attacker would have to have direct access to the user's network.

Severity Rating:

Microsoft Windows NT 4.0	Critical
Microsoft Windows NT Server 4.0 Terminal Server Edition	Critical
Microsoft Windows 2000	Critical
Microsoft Windows XP	Critical
Microsoft Windows Server 2003	Critical

The above assessment is based on the types of systems that are affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.

Vulnerability identifier: CAN-2003-0818

Top of section

Workarounds

None

Top of section

Frequently Asked Questions

What is the scope of the vulnerability?
This is a buffer overrun vulnerability. An attacker who successfully exploited this vulnerability could gain complete control over an affected system. An attacker could take any action on the system, including installing programs, viewing data, changing data, deleting data, or creating new accounts with full privileges.

What causes the vulnerability?
The vulnerability is caused by an unchecked buffer in the Microsoft ASN.1 Library. If exploited, an attacker could gain system privileges on an affected system.

What is ASN.1?
Abstract Syntax Notation 1 (ASN.1) is a data standard that is used by many applications and devices in the technology industry for allowing the normalization and understanding of data across various platforms. ASN.1 has no direct relationship to any specific standard, encoding method, programming language, or hardware platform. It is simply a language for defining standards. Or in other words, standards are written in ASN.1.
A vulnerability exists in Microsoft's ASN.1 implementation that, if exploited, could allow an attacker to cause code to execute remotely with system privileges on an affected system. More information about ASN.1 can be found in Microsoft Knowledge Base Article 252648.

What might an attacker use the vulnerability to do?
If successfully exploited, the attacker could be able to take any action on the system, including installing programs, viewing data, changing data, deleting data, or creating new accounts with full privileges.

How could an attacker exploit this vulnerability?
Because ASN.1 is a standard for many applications and devices, there are many potential attack vectors. To successfully exploit this vulnerability, an attacker must force a computer to decode malformed ASN.1 data. For example, when using authentication protocols based on ASN.1 it could be possible to construct a malformed authentication request that could expose this vulnerability.

What systems are primarily at risk from this vulnerability?
Server systems are at greater risk than client computers because they are more likely to have a server process running that decodes ASN.1 data.

I'm using Windows NT 4.0. How do I know if I need this update?
Windows NT 4.0 (Workstation, Server, and Terminal Server Edition) does not install the affected file by default. This file is installed as part of the MS03-041 Windows NT 4.0 security update and other possible non-security-related hotfixes. If the Windows NT 4.0 security update for MS03-041 is not installed, this may not be a required update. To verify if the affected file is installed, search for the file named Msasn1.dll. If this file is present, this security update is required. Windows Update, Software Update Services, and the Microsoft Security Baseline Analyzer will also correctly detect if this update is required.

What does the update do?
The update removes the vulnerability by modifying the handling of malformed data by the ASN.1 Library.

Top of section

Security Update Information

Installation Platforms and Prerequisites:

For information about the specific security update for your platform, click the appropriate link.

Windows Server 2003 (all versions)

Prerequisites

This security update requires a released version of Windows Server 2003.

Inclusion in Future Service Packs:

The fix for this issue will be included in Windows Server 2003 Service Pack 1.

Installation Information

This security update supports the following Setup switches:

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)

/uninstall Uninstalls the package

Restart Options

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options

/l Lists installed Windows hotfixes or update packages

/o Overwrite OEM files without prompting

/n Do not backup files needed for uninstall

/f Force other programs to close when the computer shuts down

Note: You can combine these switches into one command. For backwards compatibility, the security update also supports the Setup switches that are used by the previous version of the setup utility.

Deployment Information

To install the security update without any user intervention, use the following command at a command prompt for Windows Server 2003:

Windowsserver2003-kb828028-x86-enu /passive /quiet

To install the security update without forcing the computer to restart, use the following command at a command prompt for Windows Server 2003:

Windowsserver2003-kb828028-x86-enu /norestart

For information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Restart Requirement

You must restart your computer after you apply this security update.

Removal Information

To remove this update, use the Add or Remove Programs tool in Control Panel.

System administrators can use the Spuninst.exe utility to remove this security update. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB828028$\Spuninst folder. The Spuninst.exe utility supports the following Setup switches:

/?: Show the list of installation switches.

/u: Use Unattended mode.

/f: Force other programs to quit when the computer shuts down.

/z: Do not restart when the installation is complete.

/q: Use Quiet mode (no user interaction).

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Windows Server 2003, Enterprise Edition, Windows Server 2003, Standard Edition, Windows Server 2003, Web Edition, and Windows Server 2003, Datacenter Edition:

Date	Time	Version	Size	File Name	Folder
23-Oct-2003	00:52	5.2.3790.88	60,928	Msasn1.dll	RTMGDR
23-Oct-2003	00:43	5.2.3790.88	60,928	Msasn1.dll	RTMQFE

Windows Server 2003, 64-Bit Enterprise Edition and Windows Server 2003, 64-Bit Datacenter Edition:

Date	Time	Version	Size	File Name	Platform	Folder
23-Oct-2003	00:52	5.2.3790.88	160,256	Msasn1.dll	IA64	RTMGDR
23-Oct-2003	00:52	5.2.3790.88	60,928	Wmsasn1.dll	X86	RTMGDR\WOW
23-Oct-2003	00:52	5.2.3790.83	29,696	Wmspatcha.dll	X86	RTMGDR\WOW
23-Oct-2003	00:51	5.2.3790.88	160,256	Msasn1.dll	IA64	RTMQFE
23-Oct-2003	00:43	5.2.3790.88	60,928	Wmsasn1.dll	X86	RTMQFE\WOW
23-Oct-2003	00:43	5.2.3790.83	29,696	Wmspatcha.dll	X86	RTMQFE\WOW

Note: When you install this security update on a Windows Server 2003-based computer or on a Windows XP 64-Bit Edition Version 2003-based computer, the installer checks to see if any of the files that are being updated on your computer have previously been updated by a Microsoft hotfix. If you have previously installed a hotfix to update one of these files, the installer copies the RTMQFE files to your computer. Otherwise, the installer copies the RTMGDR files to your computer. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

824994 Description of the Contents of a Windows Server 2003 Product Update Package

Verifying Update Installation

To verify that a security update is installed on an affected system you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. The Microsoft Baseline Security Analyzer (MBSA) allows administrators to scan local and remote systems for missing security updates as well as common security misconfigurations. For additional information about MBSA, please visit the Microsoft Baseline Security Analyzer Web site.

You may also be able to verify the files that this security update installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP1\KB828028\Filelist

Note: This registry key may not be not created properly when an administrator or an OEM integrates or slipstreams the 828028 security update into the Windows installation source files.

Top of section

Windows XP (all versions)

Note: For Windows XP 64-Bit Edition, Version 2003, this security update is the same as the security update for 64-bit versions of Windows Server 2003.

Prerequisites

This security update requires the released version of Windows XP or Windows XP Service Pack 1 (SP1). For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

322389 How to Obtain the Latest Windows XP Service Pack

Inclusion in Future Service Packs:

The fix for this issue will be included in Windows XP Service Pack 2.

Installation Information

This security update supports the following Setup switches:

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)

/uninstall Uninstalls the package

Restart Options

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options

/l Lists installed Windows hotfixes or update packages

/o Overwrite OEM files without prompting

/n Do not backup files needed for uninstall

/f Force other programs to close when the computer shuts down

Deployment Information

To install the security update without any user intervention, use the following command at a command prompt for Windows XP:

Windowsxp-kb828028-x86-enu /passive /quiet

To install the security update without forcing the computer to restart, use the following command at a command prompt for Windows XP:

Windowsxp-kb828028-x86-enu /norestart

For information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Restart Requirement

You must restart your computer after you apply this security update.

Removal Information

To remove this update, use the Add or Remove Programs tool in Control Panel.

/?: Show the list of installation switches.

/u: Use Unattended mode.

/f: Force other programs to quit when the computer shuts down.

/z: Do not restart when the installation is complete.

/q: Use Quiet mode (no user interaction).

File Information

Windows XP Home Edition, Windows XP Professional, Windows XP Tablet PC Edition, and Windows XP Media Center Edition:

Date	Time	Version	Size	File Name	Folder
19-Sep-2003	21:21	5.1.2600.119	51,712	Msasn1.dll	(pre-sp1)
19-Sep-2003	17:37	5.1.2600.1274	51,712	Msasn1.dll	(with sp1)

Windows XP 64-Bit Edition:

Date	Time	Version	Size	File Name	Platform	Folder
19-Sep-2003	17:57	5.1.2600.119	179,200	Msasn1.dll	IA64	(pre-sp1)
19-Sep-2003	17:37	5.1.2600.119	51,712	Wmsasn1.dll	X86	(pre-sp1)
19-Sep-2003	17:57	5.1.2600.1274	179,200	Msasn1.dll	IA64	(with sp1)
19-Sep-2003	17:37	5.1.2600.1274	51,712	Wmsasn1.dll	X86	(with sp1)

Note: The Windows XP and Windows XP 64-Bit Edition versions of this security update are packaged as dual-mode packages. Dual-mode packages contain files for both the original version of Windows XP and Windows XP Service Pack 1 (SP1). For additional information about dual-mode packages, click the following article number to view the article in the Microsoft Knowledge Base:

328848 Description of Dual-Mode Hotfix Packages for Windows XP

Windows XP 64-Bit Edition Version 2003:

Date	Time	Version	Size	File Name	Platform	Folder
23-Oct-2003	00:52	5.2.3790.88	160,256	Msasn1.dll	IA64	RTMGDR
23-Oct-2003	00:52	5.2.3790.88	60,928	Wmsasn1.dll	X86	RTMGDR\WOW
23-Oct-2003	00:52	5.2.3790.83	29,696	Wmspatcha.dll	X86	RTMGDR\WOW
23-Oct-2003	00:51	5.2.3790.88	160,256	Msasn1.dll	IA64	RTMQFE
23-Oct-2003	00:43	5.2.3790.88	60,928	Wmsasn1.dll	X86	RTMQFE\WOW
23-Oct-2003	00:43	5.2.3790.83	29,696	Wmspatcha.dll	X86	RTMQFE\WOW

Note: When you install the Windows XP 64-Bit Edition Version 2003 security update, the installer checks to see if any of the files that are being updated on your computer have previously been updated by a Microsoft hotfix. If you have previously installed a hotfix to update one of these files, the installer copies the RTMQFE files to your computer. Otherwise, the installer copies the RTMGDR files to your computer. For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 824994 Description of the Contents of a Windows Server 2003 Product Update Package

824994 Description of the Contents of a Windows Server 2003 Product Update Package

Verifying Update Installation

You may also be able to verify the files that this security update installed by reviewing the following registry key:

For Windows XP Home Edition SP1; Windows XP Professional SP1; Windows XP 64-Bit Edition SP1; Windows XP Tablet PC Edition; Windows XP Media Center Edition:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP2\KB828028\Filelist

For Windows XP Home Edition; Windows XP Professional; Windows XP 64-Bit Edition:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP1\KB828028\Filelist

For Windows XP 64-Bit Edition, Version 2003:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP1\KB828028\Filelist

Note: This registry key may not be not created properly when an administrator or an OEM integrates or slipstreams the 828028 security update into the Windows installation source files.

Top of section

Windows 2000 (all versions)

Prerequisites

For Windows 2000 this security update requires Service Pack 2 (SP2), Service Pack 3 (SP3), or Service Pack 4 (SP4).

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

Inclusion in Future Service Packs:

The fix for this issue will be included in Windows 2000 Service Pack 5.

Installation Information

This security update supports the following Setup switches:

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)

/uninstall Uninstalls the package

Restart Options

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options

/l Lists installed Windows hotfixes or update packages

/o Overwrite OEM files without prompting

/n Do not backup files needed for uninstall

/f Force other programs to close when the computer shuts down

Deployment Information

To install the security update without any user intervention, use the following command at a command prompt for Windows 2000 Service Pack 2, Windows 2000 Service Pack 3, Windows 2000 Service Pack 4:

Windows2000-kb828028-x86-enu /passive /quiet

To install the security update without forcing the computer to restart, use the following command at a command line prompt for Windows 2000 Service Pack 2, Windows 2000 Service Pack 3, Windows 2000 Service Pack 4:

Windows2000-kb828028-x86-enu /norestart

For information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Restart Requirement

You must restart your computer after you apply this security update.

Removal Information

To remove this update, use the Add or Remove Programs tool in Control Panel.

/?: Show the list of installation switches.

/u: Use Unattended mode.

/f: Force other programs to quit when the computer shuts down.

/z: Do not restart when the installation is complete.

/q: Use Quiet mode (no user interaction).

File Information

Windows 2000 Service Pack 2, Windows 2000 Service Pack 3, Windows 2000 Service Pack 4:

Date	Time	Version	Size	File Name
19-Sep-2003	20:05	5.0.2195.6823	53,520	Msasn1.dll

Verifying Update Installation

You may also be able to verify the files that this security update installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB828028\Filelist

Note: This registry key may not be not created properly when an administrator or an OEM integrates or slipstreams the 828028 security update into the Windows installation source files.

Top of section

Windows NT 4.0 (all versions)

Prerequisites

This security update requires Windows NT Workstation 4.0 Service Pack 6a (SP6a), Windows NT Server 4.0 Service Pack 6a (SP6a), or Windows NT Server 4.0 Terminal Server Edition Service Pack 6 (SP6).

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

152734 How to Obtain the Latest Windows NT 4.0 Service Pack

Installation Information

This security update supports the following Setup switches:

/y: Perform removal (only with /m or /q ).

/f: Force programs to quit during the shutdown process.

/n: Do not create an Uninstall folder.

/z: Do not restart when the update completes.

/q: Use Quiet or Unattended mode with no user interface (this switch is a superset of /m ).

/m: Use Unattended mode with a user interface.

/l: List the installed hotfixes.

/x: Extract the files without running Setup.

Note: You can combine these switches into one command.

Deployment Information

To install the security update without any user intervention, use the following command at a command prompt for Windows NT Server 4.0:

Windowsnt4server-kb828028-x86-enu /q

For Windows NT Server 4.0 Terminal Server Edition:

Windowsnt4terminalserver-kb828028-x86-enu /q

For Windows NT Workstation 4.0:

Windowsnt4workstation-kb828028-x86-enu /q

To install the security update without forcing the computer to restart, use the following command at a command prompt for Windows NT Server 4.0:

Windowsnt4server-kb828028-x86-enu /z

For Windows NT Server 4.0 Terminal Server Edition:

WindowsNT4TerminalServer-KB828028-x86-enu /z

For Windows NT Workstation 4.0:

Windowsnt4workstation-kb828028-x86-enu /z

For information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Restart Requirement

You must restart your computer after you apply this security update.

Removal Information

To remove this update, use the Add or Remove Programs tool in Control Panel.

System administrators can also use the Hotfix.exe utility to remove this security update. The Hotfix.exe utility is located in the %Windir%\$NTUninstallKB828028$ folder. The Hotfix.exe utility supports the following setup switches:

/y: Perform removal (only with the /m or /q switch)

/f: Force programs to quit during the shutdown process

/n: Do not create an Uninstall folder

/z: Do not restart when the installation is complete

/q: Use Quiet or Unattended mode with no user interface (this switch is a superset of the /m switch)

/m: Use Unattended mode with a user interface

/l: List the installed hotfixes

File Information

Windows NT Workstation 4.0, Windows NT Server 4.0:

Date	Time	Version	Size	File Name
21-Sep-2003	01:05	5.0.2195.6824	53,520	Msasn1.dll

Windows NT Server 4.0 Terminal Server Edition:

Date	Time	Version	Size	File Name
21-Sep-2003	01:05	5.0.2195.6824	53,520	Msasn1.dll

Verifying Update Installation

You may also be able to verify the files that this security update installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\KB828028\File 1

Note: This registry key may not be not created properly when an administrator or an OEM integrates or slipstreams the 828028 security update into the Windows installation source files.

Top of section

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

•	eEye Digital Security for reporting the issue in MS04-007

Obtaining other security updates:

Updates for other security issues are available from the following locations:

•	Security updates are available from the Microsoft Download Center, and can be most easily found by doing a keyword search for "security_patch".
•	Updates for consumer platforms are available from the WindowsUpdate Web site.

Support:

•	Technical support is available from Microsoft Product Support Services at 1-866-PCSAFETY for customers in the U.S. and Canada. There is no charge for support calls that are associated with security updates.
•	International customers can get support from their local Microsoft subsidiaries. There is no charge for support associated with security updates. Information on how to contact Microsoft support is available at the International Support Web Site.

Security Resources:

•	The Microsoft TechNet Security Web Site provides additional information about security in Microsoft products.
•	Microsoft Software Update Services
•	Microsoft Baseline Security Analyzer (MBSA)
•	Windows Update
•	Windows Update Catalog: Please view Knowledge Base Article 323166 for more information on the Windows Update Catalog.
•	Office Update

Software Update Services (SUS):

Microsoft Software Update Services (SUS) enables administrators to quickly and reliably deploy the latest critical updates and security updates to Windows® 2000 and Windows Server™ 2003-based servers, as well as to desktop computers running Windows 2000 Professional or Windows XP Professional.

For information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Systems Management Server (SMS):

Systems Management Server can provide assistance deploying this security update. For information about Systems Management Server visit the SMS Web Site. For detailed information about the many enhancements to the security update deployment process that SMS 2003 provides, please visit the SMS 2003 Security Patch Management Web site. SMS also provides several additional tools to assist administrators in the deployment of security updates such as the SMS 2.0 Software Update Services Feature Pack and the SMS 2.0 Administration Feature Pack. The SMS 2.0 Software Update Services Feature Pack utilizes the Microsoft Baseline Security Analyzer and the Microsoft Office Detection Tool to provide broad support for security bulletin remediation. Some software updates may require administrative rights following a restart of the computer.

Note: The inventory capabilities of the SMS 2.0 Software Update Services Feature Pack may be used for targeting updates to specific computers, and the SMS 2.0 Administration Feature Pack's Elevated Rights Deployment Tool can be used for installation. This provides optimal deployment for updates that require explicit targeting using Systems Management Server and administrative rights after the computer has been restarted.

Disclaimer:

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions:

•	V1.0 (February 10, 2004): Bulletin published.
•	V1.1 (June 9, 2004): Bulletin updated to reflect updated information in the Windows NT 4.0 Security Update Information, Removal Instructions section.

Top of page