ISS BlackICE PC Protection Update cross site scripting

A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Update Handler. The manipulation leads to basic cross site scripting. Using CWE to declare the problem leads to CWE-80. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The weakness was released 09/22/2003 by Marc Ruef with scip AG (Website). The advisory is shared for download at scip.ch. This vulnerability is handled as CVE-2003-5003. The attack may be launched remotely. There are no technical details available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The current price for an exploit might be approx. USD $0-$5k at the moment. The MITRE ATT&CK project declares the attack technique as T1059.007. It is declared as proof-of-concept. The exploit is available at update.networkice.com. As 0-day the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 11492 (Sambar Server Multiple Script XSS), which helps to determine the existence of the flaw in a target environment. The bugfix is ready for download at update.networkice.com. It is recommended to disable the affected component. A possible mitigation has been published even before and not after the disclosure of the vulnerability. The vulnerability is also documented other vulnerability databases: Tenable (11492).