Vulnerability Note VU#428230

Multiple vulnerabilities in S/MIME implementations

Overview

Multiple vulnerabilities exist in different vendors' S/MIME (Secure/Multipurpose Internet Mail Extensions) implementations. The impacts of these vulnerabilities are varied and range from denial of service to potential remote execution of arbitrary code.

I. Description

The U.K. National Infrastructure Security Co-ordination Center (NISCC) has reported multiple vulnerabilities in different vendors' implementations of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol. S/MIME allows binary objects and attachments to be sent across an email system. S/MIME extends the MIME specification by including the secure data in an attachment encoded using ASN.1. If one of the entities in an email system knowingly or unknowingly send an exceptional ASN.1 element that cannot be handled properly by another party, the behavior of the application receiving such an element is unpredictable.

A test suite developed by NISCC has exposed vulnerabilities in a variety of S/MIME implementations. While most of these vulnerabilities exist in ASN.1 parsing routines, some vulnerabilities may occur elsewhere. Note that cryptographic libraries that implement S/MIME frequently provide more general-purpose cryptographic utility. In such libraries, it is common for ASN.1 parsing code to be shared between S/MIME and other cryptographic functions.

Due to the general lack of specific vulnerability information, this document covers multiple vulnerabilities in different S/MIME implementations. Information about individual vendors is available in the Systems Affected section.

Further information is available in NISCC Vulnerability Advisory - 006489/SMIME

II. Impact

The impacts associated with these vulnerabilities include denial of service, and potential execution of arbitrary code.

III. Solution

Patch or Upgrade

Apply a patch or upgrade as appropriate. Information about specific vendors is available in the Systems Affected section of this document.

Systems Affected

Vendor	Status	Date Updated
3Com	Unknown	4-Nov-2003
Alcatel	Unknown	4-Nov-2003
Apple Computer Inc.	Unknown	4-Nov-2003
At&T	Unknown	4-Nov-2003
Avaya	Unknown	4-Nov-2003
Borderware	Unknown	4-Nov-2003
BSDI	Unknown	4-Nov-2003
Check Point	Not Vulnerable	6-Nov-2003
Cisco Systems Inc.	Unknown	4-Nov-2003
Clavister	Not Vulnerable	4-Nov-2003
Computer Associates	Unknown	4-Nov-2003
Conectiva	Unknown	4-Nov-2003
COVERT Labs	Unknown	4-Nov-2003
Cray Inc.	Unknown	4-Nov-2003
D-Link Systems	Unknown	4-Nov-2003
Data General	Unknown	4-Nov-2003
Debian	Unknown	4-Nov-2003
eSoft	Unknown	4-Nov-2003
Extreme Networks	Unknown	3-Dec-2003
F5 Networks	Unknown	4-Nov-2003
Foundry Networks Inc.	Unknown	4-Nov-2003
FreeBSD	Unknown	4-Nov-2003
Fujitsu	Not Vulnerable	8-Dec-2003
Global Technology Associates	Unknown	4-Nov-2003
Guardian Digital Inc.	Unknown	4-Nov-2003
Hewlett-Packard Company	Unknown	4-Nov-2003
Hitachi	Vulnerable	6-Nov-2003
IBM	Unknown	4-Nov-2003
IBM-zSeries	Unknown	4-Nov-2003
IBM eServer	Unknown	4-Nov-2003
Ingrian Networks	Unknown	4-Nov-2003
Intel	Unknown	4-Nov-2003
Intoto	Not Vulnerable	6-Nov-2003
IP Filter	Unknown	4-Nov-2003
Juniper Networks	Unknown	4-Nov-2003
Lachman	Unknown	4-Nov-2003
Linksys	Unknown	4-Nov-2003
Lotus Software	Unknown	4-Nov-2003
Lucent Technologies	Unknown	4-Nov-2003
MandrakeSoft	Unknown	4-Nov-2003
Microsoft Corporation	Unknown	4-Nov-2003
MontaVista Software	Unknown	4-Nov-2003
Multi-Tech Systems Inc.	Unknown	4-Nov-2003
Multinet	Unknown	4-Nov-2003
NEC Corporation	Unknown	4-Nov-2003
NetBSD	Unknown	4-Nov-2003
Netfilter	Unknown	4-Nov-2003
NetScreen Technologies Inc.	Unknown	4-Nov-2003
Network Appliance	Unknown	4-Nov-2003
Nokia	Unknown	4-Nov-2003
Nortel Networks	Not Vulnerable	4-Nov-2003
Novell	Unknown	4-Nov-2003
OpenBSD	Unknown	4-Nov-2003
Openwall GNU/*/Linux	Unknown	4-Nov-2003
Oracle Corporation	Unknown	4-Nov-2003
Red Hat Inc.	Unknown	4-Nov-2003
Redback Networks Inc.	Unknown	4-Nov-2003
Riverstone Networks	Unknown	4-Nov-2003
SCO	Unknown	4-Nov-2003
Secure Computing Corporation	Unknown	4-Nov-2003
SecureWorx	Unknown	4-Nov-2003
Sequent	Unknown	4-Nov-2003
SGI	Unknown	4-Nov-2003
Sony Corporation	Unknown	4-Nov-2003
Stonesoft	Unknown	4-Nov-2003
Sun Microsystems Inc.	Not Vulnerable	14-Nov-2003
SuSE Inc.	Unknown	4-Nov-2003
Symantec Corporation	Unknown	4-Nov-2003
Tumbleweed Communications Corp.	Not Vulnerable	13-Nov-2003
TurboLinux	Unknown	4-Nov-2003
Unisys	Unknown	4-Nov-2003
WatchGuard	Unknown	4-Nov-2003
Wind River Systems Inc.	Unknown	4-Nov-2003
Wirex	Unknown	4-Nov-2003
Xerox Corporation	Not Vulnerable	25-Nov-2003
zyXEL	Unknown	4-Nov-2003

References

http://www.uniras.gov.uk/vuls/2003/006489/smime.htm
http://www.ietf.org/rfc/rfc2633.txt
http://www.itu.int/ITU-T/asn1/

Credit

These vulnerabilities were discovered and researched by the NISCC Vulnerability Management Team.

This document was written by Chad R Dougherty based on information from NISCC.

Other Information

Date Public	11/04/2003
Date First Published	11/04/2003 01:48:20 PM
Date Last Updated	12/08/2003
CERT Advisory
CVE-ID(s)	CAN-2003-0564
NVD-ID(s)	CAN-2003-0564
US-CERT Technical Alerts
Metric	8.51
Document Revision	13

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader