Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Thursday June 13 2019, @05:46PM   Printer-friendly

Submitted via IRC for SoyCow1944

Bad Cert Vulnerability Can Bring Down Any Windows Server

A Google security expert today revealed that an unpatched issue in the main cryptographic library of Microsoft's operating system can cause a denial-of-service (DoS) condition in Windows 8 servers and above.

The problem is in SymCrypt, the primary library for implementing symmetric cryptographic algorithms in Windows 8 and also for asymmetric ones starting with Windows 10 version 1703.

Tavis Ormandy, a vulnerability researcher at Google, noticed that SymCrypt could easily be used to cause a never-ending operation "when calculating the modular inverse on specific bit patterns with bcryptprimitives!SymCryptFdefModInvGeneric."

He was able to test the bug with the help of a specially crafted X.509 digital certificate that prevents completing the verification process. Any program on the system that processes the certificate triggers the vulnerability.

Affected systems can receive a malformed certificate in multiple ways since it is used in secure internet protocols (e.g. TLS) or for validating identity in digital signatures.

Thus, it can be delivered in digitally signed and encrypted messages via the S/MIME protocol or through a Secure Channel (schannel) connection that provides authentication between clients and servers.

The researcher considers the bug has low severity but can help an attacker take down a "Windows fleet" in a short period.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by DannyB on Thursday June 13 2019, @08:14PM

    by DannyB (5839) Subscriber Badge on Thursday June 13 2019, @08:14PM (#855266) Journal

    There are:

    Windows 2003 Server
    Windows 2008 Server (and some revisions, r1, r2, etc)
    Windows 2012 Server
    Windows 2016 Server

    And probably a few others I haven't had the displeasure of meeting. They come in various editions: Standard, . . . , Data Center Edition, and some few editions in between.

    It is the lesson from the book "Big Blue: IBM's use and abuse of power". Segment your market. Tartar Control. Extra Whiting. With Baking Soda. With Peroxide. Tartar Control with Extra Whitening. Home Basic. Professional. Enterprise Edition. Server. Data Center Edition. Etc.

    --
    People today are educated enough to repeat what they are taught but not to question what they are taught.
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2