Internet Security Systems' BlackICE and RealSecure contain a heap overflow in the processing of SMB packets

Overview Internet Security Systems' BlackICE and RealSecure intrusion detection products contain a remotely exploitable vulnerability. Exploitation of this vulnerability could lead to the compromise of the system with privileges of the vulnerable process, typically the "SYSTEM" user. Description...

CVE-2003-1527

BlackICE Defender 2.9.cap and Server Protection 3.5.cdf, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets...

blackicepro.txt

Hi! I'm using BlackICE PC Protection formerly known as BlackICE Defender for a very long time1, 2. It is one of my favorite hostbased intrusion detection systems and personal firewall for windows. During some tests for a paper on cross site scripting I've seen that there is an evasion possibility...

CVE-2002-0956

BlackICE Agent 3.1.eal does not always reactivate after a system standby, which could allow remote attackers and local users to bypass intended firewall restrictions...

CVE-2002-0957

The default configuration of BlackICE Agent 3.1.eal and 3.1.ebh has a high tcp.maxconnections setting, which could allow remote attackers to cause a denial of service memory consumption via a large number of connections to the BlackICE system that consumes more resources than intended by the user...

CVE-2002-0956

CVE-2002-0956 affects BlackICE Agent 3.1.eal. The vulnerability: the product does not always reactivate after system standby, which could allow remote attackers and local users to bypass intended firewall restrictions. Documents indicate this could impact users relying on this firewall/IDS on Win...

CVE-2002-0957

The default configuration of BlackICE Agent 3.1.eal and 3.1.ebh has a high tcp.maxconnections setting, which could allow remote attackers to cause a denial of service memory consumption via a large number of connections to the BlackICE system that consumes more resources than intended by the user...

CVE-2002-0957

CVE-2002-0957 affects BlackICE Agent 3.1.eal and 3.1.ebh. The issue arises from a default configuration with a high tcp.maxconnections, which could allow remote attackers to cause a denial of service through a large number of connections that consume memory. The provided documents do not specify ...

CVE-2002-0956

BlackICE Agent 3.1.eal does not always reactivate after a system standby, which could allow remote attackers and local users to bypass intended firewall restrictions...

CVE-2002-0237

The CVE-2002-0237 issue affects ISS BlackICE Defender (2.9 and earlier), BlackICE Agent (3.0 and 3.1), and RealSecure Server Sensor (6.0.1 and 6.5). A buffer overflow in the ICMP handling exposes a remote attacker to crash the service (DoS) and, in some cases, potentially execute arbitrary code b...

CVE-2002-0237

Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via a flood of large ICMP ping packets...

CVE-2002-0237

Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via a flood of large ICMP ping packets...

ISS BlackICE / RealSecure Large ICMP Ping Packet Overflow DoS

The remote host appears to be running either BlackICE or RealSecure Server Sensor. This application has a remote buffer overflow vulnerability. It was possible to crash the application by flooding it with 10 KB ping packets. A remote attacker could exploit this to cause a denial of service, or...

BlackIce 2.9 car Latest with patch "DOS attacks with URG Flag Set ARE NOT LOGGED"

Hello I am not sure if I already sent this last week ... Had Server problem. Peace .---------------. / NtWaK0 Advisory +-----------------------------------------------------------------------. : Affected : BlackIce 2.9 car Latest with patch : Type : DOS attacks with URG Flag Set ARE NOT LOGGED :...

Обход аудита в blackice (audit bypass)

Не логаются пакеты имеющие флаг URG...

Переполнение буфера в BlackICE (buffer overflow)

Сервер падает от ICMP-флуда...

ALERT: ISS BlackICE Kernel Overflow Exploitable

ALERT: ISS BlackICE Kernel Overflow Exploitable Release Date: February 8, 2002 Severity: High Systems Affected: BlackICE Defender 2.9 BlackICE Defender for Server 2.9 BlackICE Agent for Workstation 3.0 and 3.1 BlackICE Agent for Server 3.0 and 3.1 RealSecure Server Sensor 6.0.1 and 6.5 Descriptio...

Cisco Secure IDS 2.0/3.0 / Snort 1.x / ISS RealSecure 5/6 / NFR 5.0 - Encoded IIS Detection Evasion

source: https://www.securityfocus.com/bid/3292/info The Microsoft IIS web server supports a non-standard method of encoding web requests. Because this method is non-standard, intrusion detection systems may not detect attacks encoded using this method. This vulnerability only affects intrusion...

CVE-2000-0562

BlackIce Defender 2.1 and earlier, and BlackIce Pro 2.0.23 and earlier, do not properly block Back Orifice traffic when the security setting is Nervous or lower...

CVE-2000-0562

BlackIce Defender 2.1 and earlier, and BlackIce Pro 2.0.23 and earlier, fail to block Back Orifice traffic when the security setting is Nervous or lower. The CVE-2000-0562 entry documents this condition for these products, indicating a partial confidentiality, integrity, and availability impact w...