SMB: ISS AccountName Overflow Exploit

This signature detects buffer overflow attempts against an Internet Security Systems (ISS) Intrusion Detection device. Attackers may send an excessively long AccountName argument in an SMB packet to overflow a buffer inside the device, enabling them to remotely execute code with SYSTEM privileges.

Extended Description

The Internet Security Systems (ISS) Protocol Analysis Module, included in multiple ISS products, is prone to a remotely exploitable heap overrun vulnerability. The issue exists in the SMB parsing routines provided by the module and is due to insufficient bounds checking of protocol fields. This issue could potentially be exploited to execute arbitrary code on systems hosting the vulnerable software, potentially resulting in system compromise.

Affected Products

Ibm proventia_g_series,Ibm realsecure_server_sensor

References

BugTraq: 9752

CVE: CVE-2004-0193

URL: http://xforce.iss.net/xforce/alerts/id/165

Short Name

SMB:EXPLOIT:ISS-ACCOUNTNAME-OF

Severity

Critical

Recommended

False

Recommended Action

Drop

SMB: ISS AccountName Overflow Exploit

Extended Description

Affected Products

References

Found a potential security threat?