Internet Security Systems BlackICE PC Protection blackd.exe Local Buffer Overrun Vulnerability
BID:9514
Info
Internet Security Systems BlackICE PC Protection blackd.exe Local Buffer Overrun Vulnerability
| Bugtraq ID: | 9514 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-2125 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 28 2004 12:00AM |
| Updated: | Jul 12 2009 02:06AM |
| Credit: | Discovery is credited to Secure Network Operations. |
| Vulnerable: |
Internet Security Systems RealSecure Desktop 7.0 ebg Internet Security Systems RealSecure Desktop 3.6 eca Internet Security Systems BlackIce Server Protection 3.6 cbz Internet Security Systems BlackICE PC Protection 3.6 cbd Internet Security Systems BlackICE PC Protection 3.6 .cbz Internet Security Systems BlackICE Agent for Server 3.6 eca |
| Not Vulnerable: |
Internet Security Systems RealSecure Desktop 7.0 ebh Internet Security Systems RealSecure Desktop 3.6 ecb Internet Security Systems BlackIce Server Protection 3.6 ccb Internet Security Systems BlackICE PC Protection 3.6 ccb Internet Security Systems BlackICE Agent for Server 3.6 ecb |
Discussion
Internet Security Systems BlackICE PC Protection blackd.exe Local Buffer Overrun Vulnerability
It is reported that BlackICE PC Protection is prone to a locally exploitable buffer overrun when handling excessive input in certain configuration directives for various .ini files included with the software. While these files are allegedly not writeable by non-administrative users in the default install, it has been reported that they may be globally writeable by all system users after a software upgrade (as described in BID 9513).
Given the ability of a local attacker to modify the contents of these files, it will be possible to execute arbitrary with SYSTEM privileges since these files are parsed by the blackd.exe process, which runs in SYSTEM context.
This issue could also be exploited remotely if an attacker can exploit other vulnerabilities to cause a malicious version of a .ini file to be placed on the local system. This might occur through exploitation of latent vulnerabilities in Internet Explorer, such as those described in BID 8577.
It is reported that BlackICE PC Protection is prone to a locally exploitable buffer overrun when handling excessive input in certain configuration directives for various .ini files included with the software. While these files are allegedly not writeable by non-administrative users in the default install, it has been reported that they may be globally writeable by all system users after a software upgrade (as described in BID 9513).
Given the ability of a local attacker to modify the contents of these files, it will be possible to execute arbitrary with SYSTEM privileges since these files are parsed by the blackd.exe process, which runs in SYSTEM context.
This issue could also be exploited remotely if an attacker can exploit other vulnerabilities to cause a malicious version of a .ini file to be placed on the local system. This might occur through exploitation of latent vulnerabilities in Internet Explorer, such as those described in BID 8577.
Exploit / POC
Internet Security Systems BlackICE PC Protection blackd.exe Local Buffer Overrun Vulnerability
The researchers who discovered this vulnerability have developed a working exploit that is not publicly available or known to be circulating in the wild.
The researchers who discovered this vulnerability have developed a working exploit that is not publicly available or known to be circulating in the wild.
Solution / Fix
Internet Security Systems BlackICE PC Protection blackd.exe Local Buffer Overrun Vulnerability
Solution:
The vendor has released fixes to address this issue. Users are advised to upgrade to fixed versions via the Application Protection feature of the software.
Solution:
The vendor has released fixes to address this issue. Users are advised to upgrade to fixed versions via the Application Protection feature of the software.
References
Internet Security Systems BlackICE PC Protection blackd.exe Local Buffer Overrun Vulnerability
References:
References:
- BlackICE multiple products blackd.exe script buffer overflow (Internet Security Systems)
- BlackICE PC Protection Homepage (Internet Security Systems)
- SRT2004-01-17-0227 - BlackICE allows local users to become SYSTEM (KF