IIS ASN.1 Bit String SPNEGO exploit v1.9

Vulnerability exploited: CAN-2003-0818 - BID-9633

Category: Exploits/Remote

Exploits MSASN1.DLL Bit string bug through the SPNEGO authentication protocol.
Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 encodings that cause arbitrary heap data to be overwritten.

Supported Systems:
    Windows 2000 Professional - sp0 (i386)
    Windows 2000 Professional - sp1 (i386)
    Windows 2000 Professional - sp2 (i386)
    Windows 2000 Professional - sp3 (i386)
    Windows 2000 Professional - sp4 (i386)
    Windows 2000 Server - sp0 (i386)
    Windows 2000 Server - sp1 (i386)
    Windows 2000 Server - sp2 (i386)
    Windows 2000 Server - sp3 (i386)
    Windows 2000 Server - sp4 (i386)
    Windows 2000 Advanced Server - sp0 (i386)
    Windows 2000 Advanced Server - sp1 (i386)
    Windows 2000 Advanced Server - sp2 (i386)
    Windows 2000 Advanced Server - sp3 (i386)
    Windows 2000 Advanced Server - sp4 (i386)


This module is included in the latest version of CORE IMPACT, the first automated comprehensive penetration testing product for accurately identifying information security risks. Click here to learn more about the product.