CVE-2003-0818
Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 82.2%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 82.24% probability · 100th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/windows 2000 · microsoft/windows 2003 server · microsoft/windows nt · microsoft/windows xp
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=107643836125615&w=2
- http://marc.info/?l=bugtraq&m=107643892224825&w=2
- http://marc.info/?l=ntbugtraq&m=107650972617367&w=2
- http://marc.info/?l=ntbugtraq&m=107650972723080&w=2
- http://www.kb.cert.org/vuls/id/216324Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/583108US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA04-041A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-007
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A653
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A796
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A797
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A799
- http://marc.info/?l=bugtraq&m=107643836125615&w=2
- http://marc.info/?l=bugtraq&m=107643892224825&w=2
- http://marc.info/?l=ntbugtraq&m=107650972617367&w=2
- http://marc.info/?l=ntbugtraq&m=107650972723080&w=2
- http://www.kb.cert.org/vuls/id/216324Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/583108US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA04-041A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-007
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A653
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A796
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A797
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A799
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.