Internet Security Systems BlackICE PC Protection Firewall.INI Local Buffer Overrun Vulnerability

Bugtraq ID:	10915
Class:	Boundary Condition Error
CVE:	CVE-2004-1714
Remote:	No
Local:	Yes
Published:	Aug 11 2004 12:00AM
Updated:	Jul 12 2009 06:16AM
Credit:	Discovery of this vulnerability is credited to Paul Craig of Pimp Industries.
Vulnerable:	Internet Security Systems BlackIce Server Protection 3.6 cch Internet Security Systems BlackIce Server Protection 3.6 ccg Internet Security Systems BlackIce Server Protection 3.6 ccf Internet Security Systems BlackIce Server Protection 3.6 cce Internet Security Systems BlackIce Server Protection 3.6 ccd Internet Security Systems BlackIce Server Protection 3.6 ccc Internet Security Systems BlackIce Server Protection 3.6 ccb Internet Security Systems BlackIce Server Protection 3.6 cca Internet Security Systems BlackIce Server Protection 3.6 cbz Internet Security Systems BlackIce Server Protection 3.6 cbr Internet Security Systems BlackIce Server Protection 3.6 .cno Internet Security Systems BlackIce Server Protection 3.5 cdf Internet Security Systems BlackICE PC Protection 3.6 ccg Internet Security Systems BlackICE PC Protection 3.6 ccf Internet Security Systems BlackICE PC Protection 3.6 cce Internet Security Systems BlackICE PC Protection 3.6 ccd Internet Security Systems BlackICE PC Protection 3.6 ccc Internet Security Systems BlackICE PC Protection 3.6 ccb Internet Security Systems BlackICE PC Protection 3.6 cca Internet Security Systems BlackICE PC Protection 3.6 cbz Internet Security Systems BlackICE PC Protection 3.6 cbr Internet Security Systems BlackICE PC Protection 3.6 cbd Internet Security Systems BlackICE PC Protection 3.6 .cbz
Not Vulnerable:

Internet Security Systems BlackICE PC Protection Firewall.INI Local Buffer Overrun Vulnerability

It is reported that BlackICE PC Protection is prone to a local buffer overrun when handling excessive input in certain configuration directives parsed from the firewall.ini file included with the software.

It is reported that when the system is restarted, and the affected software reads the malicious firewall.ini file both the blackice.exe and blackd.exe executables will crash.

Internet Security Systems BlackICE PC Protection Firewall.INI Local Buffer Overrun Vulnerability

The following example is available:

REJECT, 138, default, 1999-07-22 20:26:53, AAAAAAAAAAAAAAAAA.... , 2000,
unknown

(Aprox 1000 A's)

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Internet Security Systems BlackICE PC Protection Firewall.INI Local Buffer Overrun Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Internet Security Systems BlackICE PC Protection Firewall.INI Local Buffer Overrun Vulnerability

References:

• BlackICE Homepage (Internet Security Systems)
  
• BlackICE PC Protection Homepage (Internet Security Systems)
  
• BlackICE unprivileged local user attack ("Paul Craig - Pimp Industries" )
  
• ISS BlackIce Server Protect Unprivileged User Attack ("Thomas Ryan" )