CVE-2004-0362

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 73%

from disclosure to weapon5 days

Published on NVDMar 23

1st PoC+5d

metasploitMar 18

exploitation probability

73%top 1% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/16464unverified exploitdbwww.exploit-db.com/exploits/168unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://marc.info/?l=bugtraq&m=107965651712378&w=2 http://secunia.com/advisories/11073 https://exchange.xforce.ibmcloud.com/vulnerabilities/15442 https://exchange.xforce.ibmcloud.com/vulnerabilities/15543 http://www.ciac.org/ciac/bulletins/o-104.shtml http://www.eeye.com/html/Research/Advisories/AD20040318.html http://www.kb.cert.org/vuls/id/947254 http://www.osvdb.org/4355 http://www.securityfocus.com/bid/9913 http://xforce.iss.net/xforce/alerts/id/166