PT-2004-1361 · Iss · Proventia A Series+6

Barnaby Jack · Published 2004-03-15 · Updated 2017-10-10 · CVE-2004-0193

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RealSecure Network versions 7.0 RealSecure Desktop versions 7.0 and 3.6 RealSecure Guard version 3.6 RealSecure Sentry version 3.6 Proventia A, G, and M Series (affected versions not specified) BlackICE PC Protection version 3.6 BlackICE Server Protection version 3.6

Description A heap-based buffer overflow issue exists in the ISS Protocol Analysis Module (PAM) used in certain products. This issue allows remote attackers to execute arbitrary code via an SMB packet containing an authentication request with a long username.

Recommendations For RealSecure Network version 7.0, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For RealSecure Desktop versions 7.0 and 3.6, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For RealSecure Guard version 3.6, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For RealSecure Sentry version 3.6, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For Proventia A, G, and M Series, contact the vendor for guidance on updating to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For BlackICE PC Protection version 3.6, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module. For BlackICE Server Protection version 3.6, update to a version that includes a fix for the heap-based buffer overflow issue in the ISS Protocol Analysis Module.

Fix

Related Identifiers

CVE-2004-0193

Affected Products

Blackice Pc Protection

Blackice Server Protection

Proventia A Series

Realsecure Desktop

Realsecure Guard

Realsecure Network

Realsecure Sentry

References · 10

• http://kb.cert.org/vuls/id/150326 · Patch
• http://eeye.com/html/Research/Upcoming/20040213.html · Vendor Advisory
• http://xforce.iss.net/xforce/alerts/id/165 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0193 · Security Note
• http://eeye.com/html/Research/Advisories/AD20040226.html · Note
• http://securityfocus.com/bid/9752 · Note
• http://secunia.com/advisories/10988 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15207 · Note
• http://osvdb.org/4072 · Note
• http://marc.info/?l=bugtraq&m=107789851117176&w=2 · Note