ANS.1 Windows Vulnerability Released

So, I just spent the past couple of hours experimenting with this. I've been running
FILEMON, the file process usage utility from Sysinternals. This tool tells you what files
are accessed by other files. Very useful little tool to have. You can see exactly what
files are access by applications, including DLLs.

I started up my XP Pro laptop, and started monitoring it with FILEMON. I ran a filter,
just looking for MSASN1.DLL, which is the file with the problem that the eEye exploited
for this.

And boy howdy! Here is what I found.

In the Microsoft and eEye articles on this, they state that Internet Explorer, Outlook, and Outlook Express all call this file, so they could, in theory, all can be used as attack vectors. From my own testing, this is true. When you start up those programs, they ALL call MSASN1.DLL.

So, if a virus was sent via e-mail, then it could trigger this exploit. I can see that.

For example, I had IE open, then I opened a 2nd instance of IE, and the MSASN1.DLL file was called again. It looks like if multiple instances of IE are opened, then this file gets called multiple times.

Therefore, could someone make one of those "malformed URLs" to trigger this? Click the link on a webpage, and WHAMMO!!!???

MSN Messenger called the file when I started it; actually, when OE opened, it started MSN Mesenger (msmsgs.exe), which called the DLL. I did not chat with anyone to see if the file was called again after start, so I don't know if MSN Messenger uses it after you start it. But it did call it.

Our friend, SVCHOST.EXE, called the file a lot! This explains the port 139 and 445 references in the eEye notices. I was not able to test inbound port 139/445 functionality, though. But, since the Windows File and Print Sharing is ran by SVCHOST, that is probably why the eEye listed it. Also, other apps that use SVCHOST.EXE only listed the SVCHOST calling the DLL file, like MMC snap-ins. So, the snap-ins did not register a hit for themselves, just in SVCHOST.

I wonder, therefore, if RCP (port 135) could also be vulnerable, but I didn't try and test that functionality.

Other stuff I found that I have not seen listed anywhere so far:

WMIPRVSE.EXE called the file. This file is used by XP and Win2K3 to handle the WMI functionality (Windows Management Instrumentation, I believe). I ran into this one just by running TASKLIST.EXE, which uses WMI to work. It would be interesting to see on a Win2K box (which runs all WMI processes under the WINMGMT.EXE process only; XP now breaks them out into the 2 processes). So, since TASKLIST, which is a WMI process, caused WMIPRVSE.EXE to call the DLL, then I guess other WMI process/functions would do the same on XP and Win2K3. This worries me. What if the virus was in WMI script, and transmitted and ran on a target system. WMI script can be ran against remote machines that support WMI! So, you would not need to have the virus file physically on the machine. It could be a Blaster-type virus/worm them that used WMI to infect and propagate!

Also, when I ran .VBS scripts, my XP machine is set to run them under CSCRIPT.EXE, the default VP interpreter. Yes, CSCRIPT.EXE called the DLL. So, a .VBS file could also cause this exploit to happen (if they use CSCRIPT.EXE to run under), and VBS files can also be ran against remote targets.

The Bliss screensaver for XP, which you can get from the Microsoft website, called the file (BLISS.SCR). Really! A screen saver file! This was the only one I had that did that.

One that tripped me out was IPCONFIG.EXE! Yep! Do an IPCONFIG, and it will actually call this DLL file! Why, I don't want to figure out why, but it did every time for me.

Now, a few non-Windows apps. First, there was Real One Player! One of its processes is "realsched.exe" which is the process that can always run and give you those annoying popups every once in a while when there is a new news notice from the Real company. You know, those obnoxious little popup windows that says to upgrade Real One to a new version, or there is some new content for the Real ONe Player. Well, "realsched.exe" calls "realevent.exe", which calls this DLL. So, if Real One Player loads, these two EXE files are loaded, which calls the DLL. So, it seems then that if someone sent a file that caused Real One Player to load, it could trigger this exploit!

Symantec Antivirus Corporate Edition 8.0 client did not call the DLL, but when I opened the Symante LiveUpdate applet in the Control Panel, that did call it (from LUCOMS~1.exe). So, LiveUpdate needs the DLL, and I guess could, in some way, help spread the exploit. I have the latest LiveUpdate installed (Symantec just updated it in January 2004).

And one that might not be anything to worry about is ZoneAlarm. My copy of ZA had a single hit for the DLL. The info column reads "FileBothDirectoryInformation: MSASN1.DLL" for ZAPRO.EXE, which is ZoneAlarm. Now, I am not sure if the DLL tried to access the Internet, and ZA recorded just this one file access, or what exactly. I did not see any other ZA hits for the file, but I only ran ZA for about 5 minutes. So, I am not sure if this is important or not. Interesting, though.

Lastly, Ad-aware hit the DLL file when I did a system scan, but I think it was only CHECKING the file to see if it had been replaced by a spyware file.

So, that is all I found. Some things I tried that did not call the DLL file surprised me. I could not get IE to hit the DLL file when I went to SSL-secured web pages. Windows Media Player (with protected content .WMV files) did not call it, nor did Winamp5. No Office 2000 products (other than Outlook) triggered the DLL. Quicktime player was safe. Lotus Notes client did not call the DLL. Quicken 2002 was good! Citrix ICA client was clean.

Now, this is by no means any type of scientific list. I just ran FILEMON for a couple of hours and opened everything I could think of, and just read through the file list. Other people should look into this, and see what they get. There are a lot of programs out there that I don't have, that others do, and we should see what calls this file and what doesn't.

I did all this tonight, because I am really worried about this. The notices said that if something calls MSASN1.DLL, then it can be used to exploit MSASN1.DLL with a buffer overflow, which could then let the attacker do whatever they want (ala Blaster). But with this one, there isn't just one port that could be attacked. Multiple ways of doing this, with multiple applications that can be attacked. Different scripting types. The articles do mention that SSL can be used to attack (in theory).

To me, this one seems to be worse IN THEORY then Blaster's attack.

I am testing the patch out on a few machines Wednesday, just to make sure it is a good patch. I plan on getting my DMZ machines on with the patch on Friday, then other machines the following week. It will probably take a while before the virus/worm is released to attack this one. Blaster took 3 weeks to hit, from patch release to virus release. I am hoping for a similar timeframe on this.

Just wanted to post this to let everyone know. It's past 1AM now. Time to call it a day.

One last thing: I am not a programmer. Keep this in mind. But I like to think I know a few things on how Windows works!

.
This is some great information, Joseph. Thanks for posting it. You're always right on top of these Windows security issues.

By the way, it's interesting that there are so few replies to this. Perhaps if the title of the thread was, "George Bush Caused Windows Security Problem", it would generate more interest.

No. I have that sevice turned off!! I only ever run it as a manual command from the cmd prompt. I myself 'tweak' system files (I AM a programmer!!) and am a firm believer that half the so-called critical system files are just redundant bloatware. What do half these DLL's actually DO?!!

I run a suite of program called WLCHECK and WFNCHECK from Karrisoft, which traces calls to and from DLL's. It not only shows calls and dependencies, but enumerates actual functions within the dlls too. Almost a quarter of the windows\system folder can actually be deleted without making a blind bit of difference.

I found this as a result of getting involved with Internet Exploder...a project to entirely remove IE from Windows 98SE, leaving a very compact OS only requiring 48Mb of disk space. When building stand-alone simulators, you don't NEED or WANT a browser!!! It also comes in handy for adding 'third party' functions to VB or VC++ programs!!

So, someone illegally release some of the source code for Win2K.
I found a couple different places with a list of the files (not the files themselves, just a DIR listing of what is available).
I went over it, looking for the MSASN1 file, or some reference to it. My fear, when I heard that the source was out, was that the source to make this DLL with the big problem would be in the list. With the source, then the evil hackers out there could examine it, and find the problem in no time at all.

Here are some things I can tell from the DIR list:

Task Manager is there. The source for it is.
Also, Device Manager snap-in is there.

A bunch of stuff under the heading /windows/shell/security is there. That worries me.

RUNDLL32 is there.

Regedit is there.

Progman, the old Program Manager, is there.

Solitaire is there!

EFS is there, the encrypting file system.

There is just a lot there. Way too much to keep mentioning. Now, I really want to know is if the source code for NSANS1.DLL is there, the bad DLL! I did not see NSANS1 listed specifically, nor could I find ANS.1 or anything similar. But, there is the GINA, and WINLOGON are there. Plus, one that does look bad, is a NTCRYPTO heading.
I think that that could be it.
There is a file called "des_key.h" that is probably not good to have available!

You know, I have to stop looking at this.

The French site k-otik has a proof-of-concept exploit code that uses the ASN.1 vulnerability to trigger a shutdown of Windows.
It does an overflow in LSASS.EXE which causes it to shutdown.
AND when that happens, you get the 60 second shutdown timer that people saw with Blaster hittting RPC.

Here is what LSASS.EXE does:

Process File: lsass or lsass.exe
Process Name: Local Security Authority Service
Description: Windows Local Security Authority Server Process handles Windows security mechanisms. It verifies the validity of user logons to your computer or server. Technically, the software generates the process that is responsible for authenticating users for the Winlogon service.

"Windows security mechanisms" and that involves the DLL, MSASN1.DLL. So, this code triggers the DLL, which causes LSASS.EXE to crash, which shuts down your Windows box.
And remember this should work on NT/2K/XP/2K3.

I read a discussion thread on this code. It is said to work on TCP port 139 and 445. Plus, there is apparently room in the code to insert extra commands to run on the target system.

Great. Just great.

Hope everyone is patched.

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS04-007.asp

This is all Bush's fault of course.