CVE:CVE-2004-0362
CNNVD:CNNVD-200404-038
ISS RealSecure/BlackICE的协议分析模块(PAM，Protocol Analysis Module)用于解析网络协议来执行进一步的分析和攻击检测，使用在当前所有ISS入侵检测产品中。
ISS RealSecure/BlackICE PAM监视ICQ服务器应答处理函数中存在缓冲区溢出问题，远程攻击者可以利用这个漏洞进行远程缓冲区溢出攻击，可能以SYSTEM进程权限在系统上执行任意指令。
如果PAM ICQ应答处理程序接收到一个SRV_META_USER应答时，会为包含的Nickname， firstname， lastname和EMAIL地址会分配一个指向结构的指针，后续的函数会把这些数据临时拷贝到512字节的缓冲区，但并没有任何过滤检查。要调用这些受影响的函数，攻击者只需构建包含两个嵌套应答包的SRV_USER_ONLINE应答。攻击者可以伪造数据帧发送到受ISS产品保护的网络、设备、主机。
solution:Upgrade iss blackice_agent_server to a higher version than 3.6ebz,3.6eca,3.6ecb,3.6ecc,3.6ecd,3.6ece,3.6ecf,and avoid the version 3.6ebz,3.6eca,3.6ecb,3.6ecc,3.6ecd,3.6ece,3.6ecf; Upgrade iss blackice_pc_protection to a higher version than 3.6cbz,3.6cca,3.6ccb,3.6ccc,3.6ccd,3.6cce,3.6ccf,and avoid the version 3.6cbz,3.6cca,3.6ccb,3.6ccc,3.6ccd,3.6cce,3.6ccf; Upgrade iss blackice_server_protection to a higher version than 3.6cbz,3.6cca,3.6ccb,3.6ccc,3.6ccd,3.6cce,3.6ccf,and avoid the version 3.6cbz,3.6cca,3.6ccb,3.6ccc,3.6ccd,3.6cce,3.6ccf; Upgrade iss realsecure_desktop to a higher version than 3.6ebz,3.6eca,3.6ecb,3.6ecd,3.6ece,3.6ecf,7.0eba,7.0ebf,7.0ebg,7.0ebh,7.0ebj,7.0ebk,7.0ebl,and avoid the version 3.6ebz,3.6eca,3.6ecb,3.6ecd,3.6ece,3.6ecf,7.0eba,7.0ebf,7.0ebg,7.0ebh,7.0ebj,7.0ebk,7.0ebl; Upgrade iss realsecure_guard to a higher version than 3.6ebz,3.6eca,3.6ecb,3.6ecc,3.6ecd,3.6ece,3.6ecf,and avoid the version 3.6ebz,3.6eca,3.6ecb,3.6ecc,3.6ecd,3.6ece,3.6ecf; Upgrade iss realsecure_network_sensor to a higher version than 7.0,7.0:xpu_20.11,7.0:xpu_22.10,7.0:xpu_22.4,7.0:xpu_22.9,and avoid the version 7.0,7.0:xpu_20.11,7.0:xpu_22.10,7.0:xpu_22.4,7.0:xpu_22.9; Upgrade iss realsecure_sentry to a higher version than 3.6ebz,3.6eca,3.6ecb,3.6ecc,3.6ecd,3.6ece,3.6ecf,and avoid the version 3.6ebz,3.6eca,3.6ecb,3.6ecc,3.6ecd,3.6ece,3.6ecf; Upgrade iss realsecure_server_sensor to a higher version than 6.0,6.0.1,6.0.1_win_sr1.1,6.5,6.5:sr3.2,6.5:sr3.3,6.5_win_sr3.1,6.5_win_sr3.4,6.5_win_sr3.5,6.5_win_sr3.6,6.5_win_sr3.7,6.5_win_sr3.8,6.5_win_sr3.9,6.5_win_sr3.10,7.0:xpu22.1,7.0:xpu22.10,7.0:xpu22.11,7.0:xpu22.2,7.0:xpu22.3,7.0:xpu22.4,7.0:xpu22.5,7.0:xpu22.6,7.0:xpu22.7,7.0:xpu22.8,7.0:xpu22.9,and avoid the version 6.0,6.0.1,6.0.1_win_sr1.1,6.5,6.5:sr3.2,6.5:sr3.3,6.5_win_sr3.1,6.5_win_sr3.4,6.5_win_sr3.5,6.5_win_sr3.6,6.5_win_sr3.7,6.5_win_sr3.8,6.5_win_sr3.9,6.5_win_sr3.10,7.0:xpu22.1,7.0:xpu22.10,7.0:xpu22.11,7.0:xpu22.2,7.0:xpu22.3,7.0:xpu22.4,7.0:xpu22.5,7.0:xpu22.6,7.0:xpu22.7,7.0:xpu22.8,7.0:xpu22.9; Upgrade iss proventia_a_series_xpu to a higher version than 20.11,22.1,22.2,22.3,22.4,22.5,22.6,22.7,22.8,22.9,22.10,and avoid the version 20.11,22.1,22.2,22.3,22.4,22.5,22.6,22.7,22.8,22.9,22.10; Upgrade iss proventia_g_series_xpu to a higher version than 22.1,22.2,22.3,22.4,22.5,22.6,22.7,22.8,22.9,22.10,22.11,and avoid the version 22.1,22.2,22.3,22.4,22.5,22.6,22.7,22.8,22.9,22.10,22.11; Upgrade iss proventia_m_series_xpu to a higher version than 1.1,1.2,1.3,1.4,1.5,1.6,1.7,1.8,1.9,and avoid the version 1.1,1.2,1.3,1.4,1.5,1.6,1.7,1.8,1.9