Strix
26.1K

CVE-2004-0362

UnknownEPSS 73.33%

Last modified

CVE-2004-0362 is a vulnerability of currently unknown severity. Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.. EPSS estimates a 73.33% chance of exploitation in the next 30 days.

Description

Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.

Metrics

EPSS Probability
73.33%

99.4th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersionsUpdate
IssBlackice Agent Server3.6ebz—
IssBlackice Agent Server3.6eca—
IssBlackice Agent Server3.6ecb—
IssBlackice Agent Server3.6ecc—
IssBlackice Agent Server3.6ecd—
IssBlackice Agent Server3.6ece—
IssBlackice Agent Server3.6ecf—
IssBlackice Pc Protection3.6cbz—
IssBlackice Pc Protection3.6cca—
IssBlackice Pc Protection3.6ccb—
IssBlackice Pc Protection3.6ccc—
IssBlackice Pc Protection3.6ccd—
IssBlackice Pc Protection3.6cce—
IssBlackice Pc Protection3.6ccf—
IssBlackice Server Protection3.6cbz—
IssBlackice Server Protection3.6cca—
IssBlackice Server Protection3.6ccb—
IssBlackice Server Protection3.6ccc—
IssBlackice Server Protection3.6ccd—
IssBlackice Server Protection3.6cce—
IssBlackice Server Protection3.6ccf—
IssRealsecure Desktop3.6ebz—
IssRealsecure Desktop3.6eca—
IssRealsecure Desktop3.6ecb—
IssRealsecure Desktop3.6ecd—
IssRealsecure Desktop3.6ece—
IssRealsecure Desktop3.6ecf—
IssRealsecure Desktop7.0eba—
IssRealsecure Desktop7.0ebf—
IssRealsecure Desktop7.0ebg—
IssRealsecure Desktop7.0ebh—
IssRealsecure Desktop7.0ebj—
IssRealsecure Desktop7.0ebk—
IssRealsecure Desktop7.0ebl—
IssRealsecure Guard3.6ebz—
IssRealsecure Guard3.6eca—
IssRealsecure Guard3.6ecb—
IssRealsecure Guard3.6ecc—
IssRealsecure Guard3.6ecd—
IssRealsecure Guard3.6ece—
IssRealsecure Guard3.6ecf—
IssRealsecure Network Sensor7.0—
IssRealsecure Sentry3.6ebz—
IssRealsecure Sentry3.6eca—
IssRealsecure Sentry3.6ecb—
IssRealsecure Sentry3.6ecc—
IssRealsecure Sentry3.6ecd—
IssRealsecure Sentry3.6ece—
IssRealsecure Sentry3.6ecf—
IssRealsecure Server Sensor6.0—

Showing 50 of 93 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2004-0362?
Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.
How severe is CVE-2004-0362?
Severity scoring for CVE-2004-0362 is pending analysis. The EPSS model estimates a 73.33% probability of exploitation in the next 30 days.
How do I fix CVE-2004-0362?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2004-0362?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST