Internet Security Systems PAM SMB mailslot dos

pam-smb-mailslot-dos (27965) The risk level is classified as LowLow Risk

Description:

Internet Security Systems July 2006 XPU release of the SMB_MailSlot_Heap_Overflow contains a protocol parsing vulnerability. The SMB_MailSlot_Heap_Overflow decode provides protection for the Microsoft SMB/TCP Mailslot vulnerability (MS06-035). A remote attacker can send certain types of legitimate SMB Mailsot traffic to cause the protocol analysis module (PAM) engine to stop responding. TCP port 445 at the firewall must be open in order for the attacker to exploit this vulnerability.

Platforms Affected:

  • IBM, ISS BlackICE PC Protection 3.6 epj
  • IBM, ISS BlackICE Server Protection 3.6 epj
  • IBM, ISS Proventia Desktop 1780
  • IBM, ISS Proventia Network IDS XPU 24.39
  • IBM, ISS Proventia Network MFS XPU 1.78
  • IBM, ISS Proventia Server IPS for Windows 1.0.914.1780
  • IBM, ISS Proventia-G 1.1 and earlier XPU 24.39
  • IBM, ISS RealSecure Desktop 7.0 epj
  • IBM, ISS RealSecure Network 7.0 XPU 24.39
  • IBM, ISS RealSecure Server Sensor 7.0 XPU 24.39

Remedy:

Upgrade to the latest XPU (XPU 24.40) from the Internet Security Systems Web site. See References.

Consequences:

Denial of Service

References:

  • BugTraq Mailing List, Wed Jul 26 2006 - 23:16:03 CDT, NSFOCUS SA2006-07 : ISS RealSecure/BlackICE MailSlot Heap Overflow Detection Remote DoS Vulnerability at http://archives.neohapsis.com/archives/bugtraq/2006-07/0477.html.
  • Internet Security Systems Security Alert July 26, 2005, Protocol Parsing Bug in SMB Mailslot Parsing in ISS Products at http://xforce.iss.net/xforce/alerts/id/230.
  • Internet Security Systems Web site, Downloads at http://www.iss.net/download/.
  • NSFOCUS Web site, NSFOCUS at http://www.nsfocus.com.
  • BID-19178: Internet Security Systems SMB Mailslot Parsing Denial of Service Vulnerability
  • CVE-2006-3840: The SMB Mailslot parsing functionality in PAM in multiple ISS products with XPU (24.39/1.78/epj/x.x.x.1780), including Proventia A, G, M, Server, and Desktop, BlackICE PC and Server Protection 3.6, and RealSecure 7.0, allows remote attackers to cause a denial of service (infinite loop) via a crafted SMB packet that is not properly handled by the SMB_Mailslot_Heap_Overflow decode.
  • SA21219: RealSecure/BlackICE MailSlot Overflow Detection Denial of Service
  • SECTRACK ID: 1016590: BlackICE `SMB_MailSlot_Heap_Overflow Decode` Parsing Error Lets Remote Users Deny Service
  • SECTRACK ID: 1016591: RealSecure `SMB_MailSlot_Heap_Overflow Decode` Parsing Error Lets Remote Users Deny Service
  • SECTRACK ID: 1016592: Proventia `SMB_MailSlot_Heap_Overflow Decode` Parsing Error Lets Remote Users Deny Service
  • VUPEN/ADV-2006-2996: ISS Products XPU SMB_MailSlot_Heap_Overflow Decode Denial of Service Vulnerability

Reported:

Jul 26, 2006

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page