CVE-2004-0362

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=107965651712378&w=2
http://secunia.com/advisories/11073
http://www.ciac.org/ciac/bulletins/o-104.shtml
http://www.eeye.com/html/Research/Advisories/AD20040318.html
http://www.kb.cert.org/vuls/id/947254Patch, Third Party Advisory, US Government Resource
http://www.osvdb.org/4355
http://www.securityfocus.com/bid/9913Exploit, Patch, Vendor Advisory
http://xforce.iss.net/xforce/alerts/id/166Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15442
https://exchange.xforce.ibmcloud.com/vulnerabilities/15543
http://marc.info/?l=bugtraq&m=107965651712378&w=2
http://secunia.com/advisories/11073
http://www.ciac.org/ciac/bulletins/o-104.shtml
http://www.eeye.com/html/Research/Advisories/AD20040318.html
http://www.kb.cert.org/vuls/id/947254Patch, Third Party Advisory, US Government Resource
http://www.osvdb.org/4355
http://www.securityfocus.com/bid/9913Exploit, Patch, Vendor Advisory
http://xforce.iss.net/xforce/alerts/id/166Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15442
https://exchange.xforce.ibmcloud.com/vulnerabilities/15543

Timeline

Published: Apr 15, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-03637.5Stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004, as used in Norton Internet Securit CVE-2004-03647.5The WrapNISUM ActiveX component (WrapUM.dll) in Norton Internet Security 2004 is marked safe for scripting, which allows remote attackers to CVE-2004-03657.5The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of ser CVE-2004-03667.5SQL injection vulnerability in the libpam-pgsql library before 0.5.2 allows attackers to execute arbitrary SQL statements.CVE-2004-03675.0Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector.CVE-2004-036810.0Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code CVE-2004-03697.5Buffer overflow in Entrust LibKmp ISAKMP library, as used by Symantec Enterprise Firewall 7.0 through 8.0, Gateway Security 5300 1.0, Gatewa CVE-2004-03702.1The setsockopt call in the KAME Project IPv6 implementation, as used in FreeBSD 5.2, does not properly handle certain IPv6 socket options, w CVE-2004-03715.0Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allow CVE-2004-03722.1xine allows local users to overwrite arbitrary files via a symlink attack on a bug report email that is generated by the (1) xine-bugreport CVE-2004-03746.4Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information CVE-2004-03755.0SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 2004, Norton Personal Firewall 2003 and 2004, Client Firewall 5.01 and 5.1.1, and