.:: SUMMARY ISS - Internet Security Systems, RealSecure Desktop and BlackICE PC Protection Buffer Overflow Version: BlackIce 7.0.322, It is suspected that all previous versions of BlackIce are vulnerable. .:: BACKGROUND BlackICE products provide Intrusion Detection, personal firewall, and application protection. http://www.iss.net .:: DESCRIPTION A local buffer overflow vulnerability affect RealSecure Desktop and BlackICE PC Protection This issue is due to a failure of the application to securely copy user-supplied data into field name of rules that user create. Buffer used: A * 445 Information of Registers: EAX 41414141 ECX 41414141 EDX 41414175 EBX 00000001 ESP 0012EC5C EBP 0012EF00 ESI 0048A8E0 blackice.0048A8E0 EDI 00F29704 EIP 004055AF blackice.004055AF C 0 ES 0023 32bit 0(FFFFFFFF) P 1 CS 001B 32bit 0(FFFFFFFF) A 0 SS 0023 32bit 0(FFFFFFFF) Z 0 DS 0023 32bit 0(FFFFFFFF) S 0 FS 0038 32bit 7FFDE000(FFF) T 0 GS 0000 NULL D 0 O 0 LastErr ERROR_ALREADY_EXISTS (000000B7) EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G) ST0 empty -NAN FFFF FFD0D0C8 FFD0D0C8 ST1 empty -??? FFFF 00000000 00000000 ST2 empty -??? FFFF 00FE00CF 00CF00C7 ST3 empty -??? FFFF 00FE00CF 00CF00C7 ST4 empty -NAN FFFF FFD0D0C8 FFD0D0C8 ST5 empty -??? FFFF 00FF00D0 00D000C8 ST6 empty -??? FFFF 00000000 00000000 ST7 empty -??? FFFF 00800080 00800080 3 2 1 0 E S P U O Z D I FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT) FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1 .:: EXTRA We did not find any way to gain additional privileges .:: DISCLOSURE TIMELINE 03/22/2005 Initial vendor notification 03/25/2005 Initial vendor response 04/08/2005 Public disclosure .:: CREDIT Francisco Amato is credited with discovering this vulnerability. famato][at][infobyte][dot][com][dot][ar .:: LEGAL NOTICES Copyright (c) 2005 by [ISR] Infobyte Security Research. Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Infobyte Security Research Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from infobyte com ar Disclaimer The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.