Posts by SWAT_OP-R8R

  • Indiana Jones 4

    Indiana Jones 4 (2006)

    Page 1 of 10

    Directed by
    Steven Spielberg


    Writing credits
    Frank Darabont (screenplay)
    George Lucas (characters)
    (more)



    Add to
    MyMovies
    Genre: Action / Adventure (more)


    Plot Outline: Plot unknown.


    Production Notes/Status:
    Status: Pre-production
    Comments: Production is still scheduled to start in 2005.
    Status Updated: 6 February 2004
    Note: Since this project is categorized as being in production, the data is subject to change or could be removed completely

  • Security Update

    Microsoft Security Bulletin MS04-007 Print


    ASN.1 Vulnerability Could Allow Code Execution (828028)
    Issued: February 10, 2004
    Version Number: 1.0


    Summary
    Who should read this document: Customers who are using Microsoft® Windows®


    Impact of vulnerability: Remote Code Execution


    Maximum Severity Rating: Critical


    Recommendation: Systems administrators should apply the update immediately.


    Security Update Replacement: None


    Caveats: Windows NT 4.0 (Workstation, Server, and Terminal Server Edition) does not install the affected file by default. This file is installed as part of the MS03-041 Windows NT 4.0 security update and other possible non-security-related hotfixes. If the Windows NT 4.0 security update for MS03-041 is not installed, this may not be a required update. To verify if the affected file is installed, search for the file named Msasn1.dll. If this file is present, this security update is required. Windows Update, Software Update Services, and the Microsoft Security Baseline Analyzer will also correctly detect if this update is required.


    Tested Software and Security Update Download Locations:


    Affected Software:


    Microsoft Windows NT® Workstation 4.0 Service Pack 6a Download the update.
    Microsoft Windows NT Server 4.0 Service Pack 6a Download the update.
    Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6 Download the update.
    Microsoft Windows 2000 Service Pack 2, Microsoft Windows 2000 Service Pack 3, Microsoft 2000 Windows Service Pack 4 Download the update.
    Microsoft Windows XP, Microsoft Windows XP Service Pack 1 Download the update.
    Microsoft Windows XP 64-Bit Edition, Microsoft Windows XP 64-Bit Edition Service Pack 1 Download the update.
    Microsoft Windows XP 64-Bit Edition Version 2003, Microsoft Windows XP 64-Bit Edition Version 2003 Service Pack 1 Download the update.
    Microsoft Windows Server 2003 Download the update.
    Microsoft Windows Server 2003 64-Bit Edition Download the update.
    Tested Microsoft Windows Components:


    Affected Components:


    Microsoft ASN.1 Library
    The software listed above has been tested to determine if the versions are affected. Other versions either no longer include security update support or may not be affected. Please review the Microsoft Support Lifecycle Web site to determine the support lifecycle for your product and version.



    Technical Details
    A security vulnerability exists in the Microsoft ASN.1 Library that could allow code execution on an affected system. The vulnerability is caused by an unchecked buffer in the Microsoft ASN.1 Library, which could result in a buffer overflow.


    An attacker who successfully exploited this buffer overflow vulnerability could execute code with system privileges on an affected system. The attacker could then take any action on the system, including installing programs, viewing data, changing data, deleting data, or creating new accounts with full privileges.


    Abstract Syntax Notation 1 (ASN.1) is a data standard that is used by many applications and devices in the technology industry for allowing the normalization and understanding of data across various platforms. More information about ASN.1 can be found in Microsoft Knowledge Base Article 252648.


    Mitigating factors:


    In the most likely exploitable scenario, an attacker would have to have direct access to the user's network.


    Severity Rating:


    Microsoft Windows NT 4.0 Critical
    Microsoft Windows NT Server 4.0 Terminal Server Edition Critical
    Microsoft Windows 2000 Critical
    Microsoft Windows XP Critical
    Microsoft Windows Server 2003 Critical


    The above assessment is based on the types of systems that are affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.


    Vulnerability identifier: CAN-2003-0818



    Workarounds
    None



    Frequently Asked Questions
    What is the scope of the vulnerability?
    This is a buffer overrun vulnerability. An attacker who successfully exploited this vulnerability could gain complete control over an affected system. An attacker could take any action on the system, including installing programs, viewing data, changing data, deleting data, or creating new accounts with full privileges.


    What causes the vulnerability?
    The vulnerability is caused by an unchecked buffer in the Microsoft ASN.1 Library. If exploited, an attacker could gain system privileges on an affected system.


    What is ASN.1?
    Abstract Syntax Notation 1 (ASN.1) is a data standard that is used by many applications and devices in the technology industry for allowing the normalization and understanding of data across various platforms. ASN.1 has no direct relationship to any specific standard, encoding method, programming language, or hardware platform. It is simply a language for defining standards. Or in other words, standards are written in ASN.1.


    A vulnerability exists in Microsoft's ASN.1 implementation that, if exploited, could allow an attacker to cause code to execute remotely with system privileges on an affected system. More information about ASN.1 can be found in Microsoft Knowledge Base Article 252648.


    What might an attacker use the vulnerability to do?
    If successfully exploited, the attacker could be able to take any action on the system, including installing programs, viewing data, changing data, deleting data, or creating new accounts with full privileges.


    How could an attacker exploit this vulnerability?
    Because ASN.1 is a standard for many applications and devices, there are many potential attack vectors. To successfully exploit this vulnerability, an attacker must force a computer to decode malformed ASN.1 data. For example, when using authentication protocols based on ASN.1 it could be possible to construct a malformed authentication request that could expose this vulnerability.


    What systems are primarily at risk from this vulnerability?
    Server systems are at greater risk than client computers because they are more likely to have a server process running that decodes ASN.1 data.


    I'm using Windows NT 4.0. How do I know if I need this update?
    Windows NT 4.0 (Workstation, Server, and Terminal Server Edition) does not install the affected file by default. This file is installed as part of the MS03-041 Windows NT 4.0 security update and other possible non-security-related hotfixes. If the Windows NT 4.0 security update for MS03-041 is not installed, this may not be a required update. To verify if the affected file is installed, search for the file named Msasn1.dll. If this file is present, this security update is required. Windows Update, Software Update Services, and the Microsoft Security Baseline Analyzer will also correctly detect if this update is required.


    What does the update do?
    The update removes the vulnerability by modifying the handling of malformed data by the ASN.1 Library.