CHAT: ISS BlackIce ICQ Decoder META_USER Buffer Overflow

This signature detects attempts to exploit a known vulnerability in the ICQ decoder on ISS BlackIce network devices. Attackers can remotely execute arbitrary code.

Extended Description

It has been reported that the Internet Security Systems (ISS) Protocol Analysis Module is prone to a remote buffer overflow vulnerability when parsing the ICQ protocol. This issue exists due to insufficient bounds checking performed on certain unspecified ICQ protocol fields supplied in ICQ response data. Successful exploitation of this issue may allow a remote attacker to execute arbitrary code on a vulnerable system in order to gain unauthorized access. This attack would occur in the context of the vulnerable process. This module is used to parse network protocols and is included in a number of products provided by ISS, including various RealSecure and BlackICE releases.

Affected Products

Ibm proventia_g_series,Ibm realsecure_server_sensor

References

BugTraq: 9913

CVE: CVE-2004-0362

URL: http://www.kb.cert.org/vuls/id/947254

Short Name

CHAT:ICQ:ISS-BLACKICE-OF

Severity

Critical

Recommended

False

Recommended Action

Drop

CHAT: ISS BlackIce ICQ Decoder META_USER Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?