Vulnerabilities > CVE-2004-0362 - Buffer Overflow vulnerability in Internet Security Systems Protocol Analysis Module ICQ Parsing

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
iss
exploit available
metasploit
NVD
Published: 2004-04-15
Updated: 2017-07-11

Summary

Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.

Vulnerable Configurations

Part Description Count
Application
Iss
78
Hardware
Iss
31

Exploit-Db

  • descriptionRealSecure / Blackice iss_pam1.dll Remote Overflow Exploit. CVE-2004-0362. Remote exploit for windows platform
    idEDB-ID:168
    last seen2016-01-31
    modified2004-03-28
    published2004-03-28
    reporterSam
    sourcehttps://www.exploit-db.com/download/168/
    titleRealSecure / Blackice iss_pam1.dll Remote Overflow Exploit
  • descriptionISS PAM.dll ICQ Parser Buffer Overflow. CVE-2004-0362. Remote exploit for windows platform
    idEDB-ID:16464
    last seen2016-02-01
    modified2010-09-20
    published2010-09-20
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/16464/
    titleISS PAM.dll ICQ Parser Buffer Overflow

Metasploit

descriptionThis module exploits a stack buffer overflow in the ISS products that use the iss-pam1.dll ICQ parser (Blackice/RealSecure). Successful exploitation will result in arbitrary code execution as LocalSystem. This exploit only requires 1 UDP packet, which can be both spoofed and sent to a broadcast address. The ISS exception handler will recover the process after each overflow, giving us the ability to bruteforce the service and exploit it multiple times.
idMSF:EXPLOIT/WINDOWS/FIREWALL/BLACKICE_PAM_ICQ
last seen2020-05-23
modified2017-07-24
published2007-01-07
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/firewall/blackice_pam_icq.rb
titleISS PAM.dll ICQ Parser Buffer Overflow

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/83212/blackice_pam_icq.rb.txt
idPACKETSTORM:83212
last seen2016-12-05
published2009-11-26
reporterspoonm
sourcehttps://packetstormsecurity.com/files/83212/ISS-PAM.dll-ICQ-Parser-Buffer-Overflow.html
titleISS PAM.dll ICQ Parser Buffer Overflow

References