Microsoft does not directly state this, but a e-mail I receved from the people who found it eEye, if you do not install this patch , and if the server service is running, just your PC being on and running one of the versions of Win below is all you have to do if a worm comes out.
Our webhost who install patches at Midnight, did so at 5pm and rebooted because of it. I install the patch as soon as everyone was off our server here at work, then patched the clients the next day. PLEASE INSTALL THIS PATCH!!!! You have been warned!! Thank you, Eric Vogel ----- Original Message ----- From: "Peter Kaulback" <[EMAIL PROTECTED]> To: "pcworks" <[EMAIL PROTECTED]> Sent: Thursday, February 12, 2004 9:15 PM Subject: PCWorks: Critical Windows Vulnerability > On February 10 Microsoft released a patch affecting all versions of Windows > besides 9x/Me. Unfortunately, no workarounds exist for this issue. > http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS04-007.asp > > Details are as follows: > > <!snip> > Microsoft Security Bulletin MS04-007 > > Print > > ASN.1 Vulnerability Could Allow Code Execution (828028) > > Issued: February 10, 2004 > Version Number: 1.0 > > Summary > > Who should read this document: Customers who are using Microsoft. Windows. > > Impact of vulnerability: Remote Code Execution > > Maximum Severity Rating: Critical > > Recommendation: Systems administrators should apply the update immediately. > > Security Update Replacement: None > > Caveats: Windows NT 4.0 (Workstation, Server, and Terminal Server Edition) > does not install the affected file by default. This file is installed as > part of the MS03-041 Windows NT 4.0 security update and other possible > non-security-related hotfixes. If the Windows NT 4.0 security update for > MS03-041 is not installed, this may not be a required update. To verify if > the affected file is installed, search for the file named Msasn1.dll. If > this file is present, this security update is required. Windows Update, > Software Update Services, and the Microsoft Security Baseline Analyzer will > also correctly detect if this update is required. > > > Tested Microsoft Windows Components: > > Affected Components: > Microsoft ASN.1 Library > > The software listed above has been tested to determine if the versions are > affected. Other versions either no longer include security update support > or may not be affected. Please review the Microsoft Support Lifecycle Web > site to determine the support lifecycle for your product and version. > > Technical Details > > A security vulnerability exists in the Microsoft ASN.1 Library that could > allow code execution on an affected system. The vulnerability is caused by > an unchecked buffer in the Microsoft ASN.1 Library, which could result in a > buffer overflow. > > An attacker who successfully exploited this buffer overflow vulnerability > could execute code with system privileges on an affected system. The > attacker could then take any action on the system, including installing > programs, viewing data, changing data, deleting data, or creating new > accounts with full privileges. > > Abstract Syntax Notation 1 (ASN.1) is a data standard that is used by many > applications and devices in the technology industry for allowing the > normalization and understanding of data across various platforms. More > information about ASN.1 can be found in Microsoft Knowledge Base Article > 252648. > > Mitigating factors: > > In the most likely exploitable scenario, an attacker would have to have > direct access to the user's network. > > Severity Rating: > Microsoft Windows NT 4.0 Critical > Microsoft Windows NT Server 4.0 Terminal Server Edition Critical > Microsoft Windows 2000 Critical > Microsoft Windows XP Critical > Microsoft Windows Server 2003 Critical > > The above assessment is based on the types of systems that are affected by > the vulnerability, their typical deployment patterns, and the effect that > exploiting the vulnerability would have on them. > > Vulnerability identifier: CAN-2003-0818 > > Workarounds > > None > <!end snip> > > > -- > Peter Kaulback ============= PCWorks Mailing List ================= Don't see your post? Check our posting guidelines & make sure you've followed proper posting procedures, http://pcworkers.com/rules.htm Contact list owner <[EMAIL PROTECTED]> Unsubscribing and other changes: http://pcworkers.com =====================================================
