CVE:CVE-2004-0193
CNNVD:CNNVD-200403-071
RealSecure和BlackICE是ISS提供的给基于主机的入侵检测/防御系统，这些产品可识别和阻挡网络攻击和入侵。
RealSecure和BlackICE使用的协议分析模块在处理SMB协议时缺少充分的缓冲区边界检查，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可能以系统权限在主机中执行任意指令。
协议分析模块(Protocol Analysis Module)用于解析网络协议来执行进一步的分析和攻击检测。其中之一支持的协议是SMB协议。SMB为客户端提供远程访问资源如文件、打印机、有名管道等的机制。
由于PAM协议分析模块对"Setup AndX"的SMB请求的解析缺少充分的边界检查，结果可导致远程攻击者提交AccountName参数包含超过300字节或更长的字符串的SMB "Setup AndX"请求，可触发基于堆的溢出。不过在部分产品中，堆保护可以探测到这些内存破坏并且重启动PAM组件以清理堆内容。
SMB解析在PAM是基于状态的，必须通过TCP/IP与网络中服务器建立一个真实的SMB连接才能触发。
solution:Upgrade iss blackice_agent_server to a higher version than 3.6eca,and avoid the version 3.6eca; Upgrade iss blackice_pc_protection to a higher version than 3.6cbd,and avoid the version 3.6cbd; Upgrade iss blackice_server_protection to a higher version than 3.6cbz,and avoid the version 3.6cbz; Upgrade iss realsecure_desktop to a higher version than 3.6eca,3.6ecf,7.0ebg,7.0epk,and avoid the version 3.6eca,3.6ecf,7.0ebg,7.0epk; Upgrade iss realsecure_guard to a higher version than 3.6ecb,and avoid the version 3.6ecb; Upgrade iss realsecure_network to a higher version than 7.0:xpu_20.15,and avoid the version 7.0:xpu_20.15; Upgrade iss realsecure_sentry to a higher version than 3.6ecf,and avoid the version 3.6ecf; Upgrade iss realsecure_server_sensor to a higher version than 7.0:xpu20.16,and avoid the version 7.0:xpu20.16; Upgrade iss proventia_a_series_xpu to a higher version than 20.15,and avoid the version 20.15; Upgrade iss proventia_g_series_xpu to a higher version than 22.3,and avoid the version 22.3; Upgrade iss proventia_m_series_xpu to a higher version than 1.30,and avoid the version 1.30