Description
Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
ISS PAM.dll ICQ Parser Buffer Overflow
exploit/windows/firewall/blackice_pam_icq
Exploit-DB 2
- ISS - 'PAM.dll' ICQ Parser Buffer Overflow (Metasploit) EDB-16464 · remote · Sep 20, 2010 · verified
- RealSecure / Blackice - 'iss_pam1.dll' Remote Overflow EDB-168 · remote · Mar 28, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20040318 Vulnerability in ICQ Parsing in ISS Products third-party-advisory
- 9913 vdb-entry
- 11073 third-party-advisory
- O-104 third-party-advisory government-resource
- AD20040318 third-party-advisory
- pam-icq-parsing-bo(15442) vdb-entry
- 4355 vdb-entry
- VU#947254 third-party-advisory
- 20040318 EEYE: Internet Security Systems PAM ICQ Server Response Processing Vulnerability mailing-list
- witty-worm-propagation(15543) vdb-entry