PT-2004-1361 · Iss · Proventia A Series+6

Barnaby Jack · Publicado 2004-03-15 · Atualizado 2017-10-10 · CVE-2004-0193

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RealSecure Network versions 7.0 RealSecure Desktop versions 7.0 and 3.6 RealSecure Guard version 3.6 RealSecure Sentry version 3.6 Proventia A, G, and M Series (affected versions not specified) BlackICE PC Protection version 3.6 BlackICE Server Protection version 3.6

Description A heap-based buffer overflow issue exists in the ISS Protocol Analysis Module (PAM) used in certain products. This issue allows remote attackers to execute arbitrary code via an SMB packet containing an authentication request with a long username.

Recommendations For RealSecure Network version 7.0, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For RealSecure Desktop versions 7.0 and 3.6, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For RealSecure Guard version 3.6, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For RealSecure Sentry version 3.6, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For Proventia A, G, and M Series, contact the vendor for guidance on updating to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For BlackICE PC Protection version 3.6, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For BlackICE Server Protection version 3.6, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module.

Correção

Identificadores relacionados

CVE-2004-0193

Produtos afetados

Blackice Pc Protection

Blackice Server Protection

Proventia A Series

Realsecure Desktop

Realsecure Guard

Realsecure Network

Realsecure Sentry

Referências · 10

• http://eeye.com/html/Research/Advisories/AD20040226.html · Nota
• http://kb.cert.org/vuls/id/150326 · Correção
• http://securityfocus.com/bid/9752 · Nota
• http://secunia.com/advisories/10988 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15207 · Nota
• http://osvdb.org/4072 · Nota
• http://eeye.com/html/Research/Upcoming/20040213.html · Aviso do Fabricante
• http://xforce.iss.net/xforce/alerts/id/165 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0193 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=107789851117176&w=2 · Nota