SecurityFocus

RE: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Feb 10 2004 10:16PM
Tim Eddy (eddyt stgeorge com au) (2 replies)

Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Feb 11 2004 02:19PM
Timothy J.Miller (cerebus sackheads org) (1 replies)

Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Feb 14 2004 04:14PM
Florian Weimer (fw deneb enyo de)

Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption Feb 11 2004 11:59AM
Peter Pentchev (roam ringlet net)

On Wed, Feb 11, 2004 at 09:16:40AM +1100, Tim Eddy wrote:
> Marc,
>
> If we remove the default exemptions for Kerberos & RSVP from IPSEC with
> the "NoDefaultExempt" registry key, this still passes IKE. Therefore is
> IKE vulnerable to the ASN bug?

It would appear that it is indeed. The Internet Key Exchange protocol
is defined in RFC 2409, and section 5.2, "Phase 1 Authentication With
Public Key Encryption", states that "RSA encryption MUST be encoded in
PKCS #1 format". The PKCS #1 standard always uses ASN.1 to encode
the keys and signature schemes used.

G'luck,
Peter

--
Peter Pentchev roam (at) ringlet (dot) net [email concealed] roam (at) sbnd (dot) net [email concealed] roam (at) FreeBSD (dot) org [email concealed]
PGP key: http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553
If this sentence didn't exist, somebody would have invented it.

[ reply ]