4355 : ISS Multiple Products PAM Component ICQ Protocol Parsing Overflow
Printer | http://osvdb.org/4355 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
10	1963	over 7 years ago	about 1 year ago	14 times	90%

Timeline

Discovery Date	Vendor Informed Date	Disclosure Date	Vendor Solution Date
2004-03-08	2004-03-08	2004-03-18	2004-03-18

Time to Patch
10 days

Keywords

Witty Worm

Description

Internet Security Systems' Protocol Analysis Module (PAM) contains a flaw that allows a remote attacker to execute arbitrary code. The issue is due to a series of stack based buffer overflows in the module that monitors ICQ server responses. If an attacker sends a specially crafted UDP packet that originates with a source port of 4000, they may be able to execute arbitrary code.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public, Exploit Commercial, Exploit Wormified
Disclosure: OSVDB Verified, Vendor Verified

Solution

Upgrade to the latest version available on the vendor website, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Internet Security Systems	RealSecure Server Sensor	6.5 SR 3.10
	RealSecure Server Sensor	7.0 XPU 22.11
	BlackICE PC Protection	3.6
	RealSecure Desktop	3.6
	RealSecure Desktop	7.0
	RealSecure Guard	3.6
	RealSecure Sentry	3.6
	BlackICE Agent for Server	3.6
	Proventia A Series XPU	22.11
	Proventia G Series XPU	22.11
	Proventia M Series XPU	1.9
	RealSecure Network Sensor	7.0 XPU 22.11

References

Secunia Advisory ID: 11073
ISS X-Force ID: 15442 15543
Milw0rm: 168
Exploit Database: 168
CVE ID: 2004-0362 (see also: NVD)
Metasploit ID: 4355
SCIP VulDB ID: 568
CERT VU: 947254
Generic Exploit URL: http://immunitysec.com
Other Advisory URL: http://isc.incidents.org/diary.html?date=2004-03-20
http://research.eeye.com/html/advisories/published/AD20040318.html
http://www.eeye.com/html/Research/Advisories/AD20040318.html [ Link is 404 ]
http://xforce.iss.net/xforce/alerts/id/166
Generic Informational URL: http://securityresponse.symantec.com/avcenter/venc/data/w32.witty.worm.html
Keyword: Witty Worm

Tools & Filters

	1182
Snort	15967 2446

Credit

eEye Digital Security - infoeeye.com - eEye Digital Security

CVSSv2 Score

CVSSv2 Base Score = 7.5
Source: nvd.nist.gov | Generated: 2003-12-31 | Disagree?

Blogs

This product uses the Daylife API but is not endorsed or certified by Daylife.

This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.

None found at this time

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

Timeline

Keywords

Description

Classification

Solution

Products

Internet Security Systems

RealSecure Server Sensor

BlackICE PC Protection

RealSecure Desktop

RealSecure Guard

RealSecure Sentry

BlackICE Agent for Server

Proventia A Series XPU

Proventia G Series XPU

Proventia M Series XPU

RealSecure Network Sensor