Unscored severity · published Apr 15, 2004
CVE-2004-0362
Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE…
–
CVSS
73.3%
EPSS
No
On KEV
Description
Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.
Exploitation
Is it being used?
Exploit prediction (EPSS)73.3% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Blackice Agent Server · Iss
3.6ebz; 3.6eca; 3.6ecb; 3.6ecc; 3.6ecd; 3.6ece; +1 more · source: NVD
BP
Blackice PC Protection · Iss
3.6cbz; 3.6cca; 3.6ccb; 3.6ccc; 3.6ccd; 3.6cce; +1 more · source: NVD
BS
Blackice Server Protection · Iss
3.6cbz; 3.6cca; 3.6ccb; 3.6ccc; 3.6ccd; 3.6cce; +1 more · source: NVD
PA
Proventia A Series Xpu · Iss
20.11; 22.1; 22.2; 22.3; 22.4; 22.5; +5 more · source: NVD
PG
Proventia G Series Xpu · Iss
22.1; 22.2; 22.3; 22.4; 22.5; 22.6; +5 more · source: NVD
PM
Proventia M Series Xpu · Iss
1.1; 1.2; 1.3; 1.4; 1.5; 1.6; +3 more · source: NVD
RD
Realsecure Desktop · Iss
3.6ebz; 3.6eca; 3.6ecb; 3.6ecd; 3.6ece; 3.6ecf; +7 more · source: NVD
RG
Realsecure Guard · Iss
3.6ebz; 3.6eca; 3.6ecb; 3.6ecc; 3.6ecd; 3.6ece; +1 more · source: NVD
RN
Realsecure Network Sensor · Iss
7.0; 7.0; 7.0; 7.0; 7.0 · source: NVD
RS
Realsecure Sentry · Iss
3.6ebz; 3.6eca; 3.6ecb; 3.6ecc; 3.6ecd; 3.6ece; +1 more · source: NVD
RS
Realsecure Server Sensor · Iss
6.0; 6.0.1; 6.0.1_win_sr1.1; 6.5; 6.5; 6.5; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0362
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0362
marc.info
http://marc.info/?l=bugtraq&m=107965651712378&w=2
secunia.com
http://secunia.com/advisories/11073
www.ciac.org
http://www.ciac.org/ciac/bulletins/o-104.shtml
www.eeye.com
http://www.eeye.com/html/Research/Advisories/AD20040318.html
Patch
http://www.kb.cert.org/vuls/id/947254
www.osvdb.org
http://www.osvdb.org/4355
More from Blackice Agent Server
–
CVE-2005-2711
ISS BlackIce 3.6, as used in multiple products including BlackICE PC Protection, Server Protection, Agent for Server, and RealSecure Desktop 3.6 and 7.0, does not drop privileges…
–
CVE-2004-2125
Buffer overflow in blackd.exe for BlackICE PC Protection 3.6 and other versions before 3.6.ccb, with application protection off, allows local users to gain system privileges by…
–
CVE-2004-0193
Heap-based buffer overflow in the ISS Protocol Analysis Module (PAM), as used in certain versions of RealSecure Network 7.0 and Server Sensor 7.0, Proventia A, G, and M Series,…