Eclectic Echoes

After 6 months Microsoft confirms: We have a big security hole! (aka CERT TA04-041A)

Well it took them six months to confirm and report it to all the government, corporate and home users out there, but Microsoft has in fact confirmed that they have a new security issue—one that can be used to gain system privilidges (aka root) of any server or workstation machine. Makes me all warm and fuzzy knowing that the Department of Homeland Security and others rely on Windows servers and desktops doesn’t it?

So if you are using or administering any Windows NT / 2000 / XP machines, read the CERT warning and go get your injection of Microsoft’s mystical magic antibiotic updates (if you are using IE and a flavor of XP you can just go to the Windows Update Service). “Don’t worry… it works—trust us. We’ll keep you nice and safe…we take security very seriously, after all we studied this for six months to create these patches.” In all seriousness I hope Gates gets raked over the coals on this (especially the time issue) when he delivers a keynote speech in two weeks at a security conference.

Here’s the header of CERT’s Technical Cyber Security Alert TA04-041A:

Original issue date: February 10, 2004
Last revised: --
Source: US-CERT

A complete revision history is at the end of this document.

Systems Affected

    * Microsoft Windows NT 4.0
    * Microsoft Windows NT 4.0 TSE
    * Microsoft Windows 2000
    * Microsoft Windows XP
    * Microsoft Windows Server 2003


Overview

Multiple integer overflow vulnerabilities in the Microsoft Windows ASN.1 parser library could allow an unauthenticated, remote attacker to execute arbitrary code with SYSTEM privileges.

...