Internet Security Systems PAM SMB mailslot dos
| pam-smb-mailslot-dos (27965) |  Low Risk |
Description:
Internet Security Systems July 2006 XPU release of the SMB_MailSlot_Heap_Overflow contains a protocol parsing vulnerability. The SMB_MailSlot_Heap_Overflow decode provides protection for the Microsoft SMB/TCP Mailslot vulnerability (MS06-035). A remote attacker can send certain types of legitimate SMB Mailsot traffic to cause the protocol analysis module (PAM) engine to stop responding. TCP port 445 at the firewall must be open in order for the attacker to exploit this vulnerability.
*CVSS:
| Base Score: | 2.8 |
| Access Vector: | Remote |
| Access Complexity: | High |
| Authentication: | Not Required |
| Confidentiality Impact: | None |
| Integrity Impact: | None |
| Availability Impact: | Partial |
| Temporal Score: | 2.1 |
| Exploitability: | Unproven |
| Remediation Level: | Official-Fix |
| Report Confidence: | Confirmed |
Consequences:
Denial of Service
Remedy:
Upgrade to the latest XPU (XPU 24.40) from the Internet Security Systems Web site. See References.
References:
- BugTraq Mailing List, Wed Jul 26 2006 - 23:16:03 CDT: NSFOCUS SA2006-07 : ISS RealSecure/BlackICE MailSlot Heap Overflow Detection Remote DoS Vulnerability.
- Internet Security Systems Security Alert July 26, 2005: Protocol Parsing Bug in SMB Mailslot Parsing in ISS Products.
- Internet Security Systems Web site: Downloads.
- NSFOCUS Web site: NSFOCUS.
- BID-19178: Internet Security Systems SMB Mailslot Parsing Denial of Service Vulnerability
- CVE-2006-3840: The SMB Mailslot parsing functionality in PAM in multiple ISS products with XPU (24.39/1.78/epj/x.x.x.1780), including Proventia A, G, M, Server, and Desktop, BlackICE PC and Server Protection 3.6, and RealSecure 7.0, allows remote attackers to cause a denial of service (infinite loop) via a crafted SMB packet that is not properly handled by the SMB_Mailslot_Heap_Overflow decode.
- SA21219: RealSecure/BlackICE MailSlot Overflow Detection Denial of Service
- SECTRACK ID: 1016590: BlackICE `SMB_MailSlot_Heap_Overflow Decode` Parsing Error Lets Remote Users Deny Service
- SECTRACK ID: 1016591: RealSecure `SMB_MailSlot_Heap_Overflow Decode` Parsing Error Lets Remote Users Deny Service
- SECTRACK ID: 1016592: Proventia `SMB_MailSlot_Heap_Overflow Decode` Parsing Error Lets Remote Users Deny Service
- VUPEN/ADV-2006-2996: ISS Products XPU SMB_MailSlot_Heap_Overflow Decode Denial of Service Vulnerability
Platforms Affected:
- IBM ISS BlackICE PC Protection 3.6 epj
- IBM ISS BlackICE Server Protection 3.6 epj
- IBM ISS Proventia Desktop 1780
- IBM ISS Proventia Network IDS XPU 24.39
- IBM ISS Proventia Network MFS XPU 1.78
- IBM ISS Proventia Server IPS for Windows 1.0.914.1780
- IBM ISS Proventia-G 1.1 and earlier XPU 24.39
- IBM ISS RealSecure Desktop 7.0 epj
- IBM ISS RealSecure Network 7.0 XPU 24.39
- IBM ISS RealSecure Server Sensor 7.0 XPU 24.39
Reported:
Jul 26, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.