{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "RealSecure Network 7.0, XPU 22.11 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BlackICE Agent for Server 3.6 ecf et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Proventia M Series XPU 1.9 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Proventia G Series XPU 22.11 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Proventia A Series XPU 22.11 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "RealSecure Desktop 3.6 ecf et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "RealSecure Desktop 7.0 ebl et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "RealSecure Sentry 3.6 ecf et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "RealSecure Server Sensor 6.5 for Windows SR 3.10 et versions ant\u00e9rieures ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "RealSecure Guard 3.6 ecf et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "RealSecure Server Sensor 7.0 XPU 22.11 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "BlackICE Server Protection 3.6 ccf et versions ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "BlackICE PC Protection 3.6 ccf et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLe composant PAM (Protocol Analysis Module) facilite la reconnaissance\ndes protocoles r\u00e9seau. Les paquets ayant comme port source le port\n4000/udp seront consid\u00e9r\u00e9s comme \u00e9tant des r\u00e9ponses d\u0027un serveur ICQ v5.\nUne vuln\u00e9rabilit\u00e9 dans la routine de traitement du protocole ICQ du\ncomposant PAM dans les produits ISS cit\u00e9s (voir Syst\u00e8mes affect\u00e9s)\npermet \u00e0 un utilisateur mal intentionn\u00e9 d\u0027ex\u00e9cuter de code arbitraire \u00e0\ndistance avec les droits SYSTEM sur les agents RealSecure/BlackICE.\n\n## Contournement provisoire\n\nFiltrer le port source 4000/UDP au niveau du pare-feu.\n\n## Solution\n\nAppliquer le correctif d\u0027ISS :\n\n    http://www.iss.net/download\n",
  "cves": [],
  "links": [
    {
      "title": "Alerte id 166 d\u0027ISS :",
      "url": "http://xforce.iss.net/xforce/alerts/id/166"
    },
    {
      "title": "Avis CERTA-2004-AVI-053 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2004-AVI-053/"
    }
  ],
  "reference": "CERTA-2004-AVI-096",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-03-19T00:00:00.000000"
    },
    {
      "description": "pr\u00e9cisions sur le contournement provisoire.",
      "revision_date": "2004-03-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans le composant PAM (Protocol Analysis Module) lors\ndu traitement des r\u00e9ponses des serveurs ICQ permet l\u0027ex\u00e9cution de code\narbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 des produits Proventia, BlackICE et RealSecure d\u0027ISS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis AD20040318 d\u0027Eeye",
      "url": "http://www.eeye.com/html/Research/Advisories/AD20040318.html"
    }
  ]
}