Security threats Toolkit
Story: Bluetooth security dangers ignored, say experts
No security flaws in the ASN.1 standard
The statements about ASN.1 in the article above are incorrect. ASN.1 is a well-established standard language that is used in many different standard communications protocols to define the structure of the messages and their encodings. As a standard language, ASN.1 is very mature and very stable, and has no security vulnerabilities. Over the long history of this standard (two decades), there have been reports of security flaws in some of its implementations. Now and then there have also been allegations that the language itself had flaws, but such allegations were never substantiated.
Around the year 2002 there was a surge in the level of public concern and in the number of security vulnerability reports on certain implementations of communications protocols specified in ASN.1. As the increased level of concern was reflected in the press, many articles that mentioned security vulnerabilities associated with "ASN.1" were posted on the Web at that time, and many of those articles are still popping up today on Web searches. The issues referred to in those reports were solved by correcting bugs in the various implementations, and it was never necessary to modify the ASN.1 standard itself. Some ASN.1 implementations, such as OSS Nokalva's ASN.1 tools, were found to be free of the bugs that were plaguing certain other ASN.1 implementations, suggesting that the use of professional ASN.1 tools by a protocol implementer greatly reduces the risk of security flaws being present in the final product.
The key point, anyway, is that while some implementations may be buggy (and hence contain security weaknesses), the ASN.1 language itself has no such weaknesses.
Full Talkback thread
