CVE-2004-0193
Last modified
CVE-2004-0193 is a vulnerability of currently unknown severity. Heap-based buffer overflow in the ISS Protocol Analysis Module (PAM), as used in certain versions of RealSecure Network 7.0 and Server Sensor 7.0, Proventia A, G, and M Series, RealSecure Desktop 7.0 and 3.6, RealSecure Guard 3.6, RealSecure Sentry 3.6, BlackICE PC Protection 3.6, and BlackICE Server Protection 3.6, allows remote attackers to execute arbitrary code via an SMB packet containing an authentication request with a long username.. EPSS estimates a 8.00% chance of exploitation in the next 30 days.
Description
Heap-based buffer overflow in the ISS Protocol Analysis Module (PAM), as used in certain versions of RealSecure Network 7.0 and Server Sensor 7.0, Proventia A, G, and M Series, RealSecure Desktop 7.0 and 3.6, RealSecure Guard 3.6, RealSecure Sentry 3.6, BlackICE PC Protection 3.6, and BlackICE Server Protection 3.6, allows remote attackers to execute arbitrary code via an SMB packet containing an authentication request with a long username.
Metrics
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Iss | Blackice Agent Server | 3.6eca | — |
| Iss | Blackice Pc Protection | 3.6cbd | — |
| Iss | Blackice Server Protection | 3.6cbz | — |
| Iss | Realsecure Desktop | 3.6eca | — |
| Iss | Realsecure Desktop | 3.6ecf | — |
| Iss | Realsecure Desktop | 7.0ebg | — |
| Iss | Realsecure Desktop | 7.0epk | — |
| Iss | Realsecure Guard | 3.6ecb | — |
| Iss | Realsecure Network | 7.0 | Xpu 20.15 |
| Iss | Realsecure Sentry | 3.6ecf | — |
| Iss | Realsecure Server Sensor | 7.0 | Xpu20.16 |
| Iss | Proventia A Series Xpu | 20.15 | — |
| Iss | Proventia G Series Xpu | 22.3 | — |
| Iss | Proventia M Series Xpu | 1.30 | — |
References
- http://www.eeye.com/html/Research/Upcoming/20040213.htmlVendor Advisory
- http://www.kb.cert.org/vuls/id/150326Patch, Third Party Advisory, US Government Resource
- http://xforce.iss.net/xforce/alerts/id/165Patch, Vendor Advisory
- http://www.eeye.com/html/Research/Upcoming/20040213.htmlVendor Advisory
- http://www.kb.cert.org/vuls/id/150326Patch, Third Party Advisory, US Government Resource
- http://xforce.iss.net/xforce/alerts/id/165Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2004-0193?
How severe is CVE-2004-0193?
How do I fix CVE-2004-0193?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2004
- CVE-2004-0187Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2004-0188Heap-based buffer overflow in Calife 2.8.5 and earlier may a…
- CVE-2004-0189The "%xx" URL decoding function in Squid 2.5STABLE4 and earl…
- CVE-2004-0190Symantec FireWall/VPN Appliance model 200 records a cleartex…
- CVE-2004-0191Mozilla before 1.4.2 executes Javascript events in the conte…
- CVE-2004-0192Cross-site scripting (XSS) vulnerability in the Management S…
- CVE-2004-0194Stack-based buffer overflow in the OutputDebugString functio…
- CVE-2004-0197Buffer overflow in Microsoft Jet Database Engine 4.0 allows …
- CVE-2004-0199Help and Support Center in Microsoft Windows XP and Windows …
- CVE-2004-0200Buffer overflow in the JPEG (JPG) parsing engine in the Micr…
- CVE-2004-0201Heap-based buffer overflow in the HtmlHelp program (hh.exe) …
- CVE-2004-0202IDirectPlay4 Application Programming Interface (API) of Micr…
Are you affected by CVE-2004-0193?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST