Internet Security Systems Protocol Analysis Module (PAM) does not properly handle ICQ server response messages

Overview

The Protocol Analysis Module (PAM) used by Internet Security Systems (ISS) intrusion detection and prevention products does not properly handle ICQ server response messages. An unauthenticated, remote attacker could execute arbitrary code by sending a specially crafted UDP packet.

Description

ISS intrusion detection and prevention products include a component that performs application layer inspection of the ICQ protocol. From the ISS Alert:

The Protocol Analysis Module (PAM) facilitates the parsing of network protocols in order to perform further analysis and attack detection. ICQ is a popular instant messaging application developed by ICQ Inc., a subsidiary of America Online. In order to detect attacks targeting instant messaging software, PAM parses several IM protocols including ICQ.
A UDP packet with a source port of 4000 is handled by the PAM as an ICQ server response message. The PAM contains a stack buffer overflow in code that parses ICQ server response messages. An unauthenticated, remote attacker could exploit this vulnerability with a specially crafted UDP packet. In most cases, it is trivial for an attacker to spoof the source of a UDP packet. Since RealSecure and BlackICE products listen on the broadcast interface, an attacker may be able to reach multiple targets with one packet.

As noted in the ISS Alert, ISS Proventia, RealSecure, and BlackICE products share the vulnerable PAM code.

---

Impact

An unauthenticated, remote attacker could execute arbitrary code with the privileges of the process running the PAM. RealSecure and BlackICE products run on Microsoft Windows platforms with SYSTEM privileges.
An Internet worm called “Witty” exploits this vulnerability in RealSecure and BlackICE products on Windows systems (Proventia products are not affected). The worm overwrites sections of the target system’s hard drive, which could corrupt stored data and render the target system inoperable. For more information, please see the ISS Alert.

---

Solution

Upgrade
Upgrade as specified in the ISS Alert. ISS distributed updates prior to the public release of information about this vulnerability.

---

Block or restrict access

Block UDP packets with a source port of 4000. Note that this will prevent ICQ applications from operating.

---

Vendor Information

947254

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Internet Security Systems Inc. __ Affected

Updated: March 22, 2004

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Please see the following ISS Alerts:

Vulnerability in ICQ Parsing in ISS Products

BlackICE Witty Worm Propagation

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23947254 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.eeye.com/html/Research/Upcoming/20040308.html&gt;
• <http://www.eeye.com/html/Research/Advisories/AD20040318.html&gt;
• <http://xforce.iss.net/xforce/alerts/id/166&gt;
• <http://xforce.iss.net/xforce/alerts/id/167&gt;
• <http://www.iss.net/download/&gt;
• <http://secunia.com/advisories/11073/&gt;
• <http://www.securityfocus.com/bid/9913&gt;
• <http://www.caida.org/research/security/witty/&gt;

Acknowledgements

This vulnerability was reported by eEye Digital Security.

This document was written by Art Manion and Jason A. Rafail.

Other Information

CVE IDs:	CVE-2004-0362
Severity Metric:	30.44 Date Public: