ISS BlackICE PC Protection Update cross site scripting

EntryHistoryDiffjsonxmlCTI

A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Update Handler. The manipulation leads to basic cross site scripting. Using CWE to declare the problem leads to CWE-80. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The weakness was released 09/22/2003 by Marc Ruef with scip AG (Website). The advisory is shared for download at scip.ch. This vulnerability is handled as CVE-2003-5003. The attack may be launched remotely. There are no technical details available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The current price for an exploit might be approx. USD $0-$5k at the moment. The MITRE ATT&CK project declares the attack technique as T1059.007. It is declared as proof-of-concept. The exploit is available at update.networkice.com. As 0-day the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 11492 (Sambar Server Multiple Script XSS), which helps to determine the existence of the flaw in a target environment. The bugfix is ready for download at update.networkice.com. It is recommended to disable the affected component. A possible mitigation has been published even before and not after the disclosure of the vulnerability. The vulnerability is also documented other vulnerability databases: Tenable (11492).

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	50

Field

cna_eol	1
cna_responsible	1
source_cve_cna	1
source_cve	1
source_nessus_risk	1

Commit Conf

100%	48
90%	8
98%	4
70%	2

Approve Conf

100%	48
90%	8
98%	4
70%	2

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
12122143	01/28/2022	VulD...	eol	1		01/28/2022	accepted	100
12122142	01/28/2022	VulD...	responsible	VulDB		01/28/2022	accepted	100
12122141	01/28/2022	VulD...	cve_cna	VulDB	cve.org	01/28/2022	accepted	100
12122140	01/28/2022	VulD...	cve	CVE-2003-5003	cve.org	01/28/2022	accepted	100
11008470	03/08/2021	VulD...	nessus_risk	Medium	tenable.com	03/08/2021	accepted	70
11008469	03/08/2021	VulD...	nessus_filename	sambar_xss.nasl	tenable.com	03/08/2021	accepted	70
20675	10/08/2018	VulD...	cwe	80 (cross site scripting)		10/08/2018	accepted	90
20669	10/08/2018	VulD...	nessus_family	CGI abuses : XSS	tenable.com	10/08/2018	accepted	100
20668	10/08/2018	VulD...	nessus_name	Sambar Server Multiple Script XSS	tenable.com	10/08/2018	accepted	100
20682	09/22/2003	VulD...	cvss3_vuldb_rc	X	see CVSS documentation	09/22/2003	accepted	90
20681	09/22/2003	VulD...	cvss3_vuldb_rl	U	see CVSS documentation	09/22/2003	accepted	90
20680	09/22/2003	VulD...	cvss3_vuldb_e	P	see CVSS documentation	09/22/2003	accepted	90
20679	09/22/2003	VulD...	cvss2_vuldb_rc	ND	see CVSS documentation	09/22/2003	accepted	90
20678	09/22/2003	VulD...	cvss2_vuldb_rl	U	see CVSS documentation	09/22/2003	accepted	90
20677	09/22/2003	VulD...	cvss2_vuldb_e	POC	see CVSS documentation	09/22/2003	accepted	90
20676	09/22/2003	VulD...	location	Website		09/22/2003	accepted	90
20674	09/22/2003	VulD...	expert	ISS BlackICE PC Protection weist eine sehr simple Update-Funktionalität auf. Diese ist aus Sicherheitssicht fragwürdig, weil sensitive Informationen ohne Verschlüsselung übertragen werden. Zudem weist der Update-Mechanismus auf der Webseite eine Cross Site Scripting-Schwachstelle auf. Es bleibt abzuwarten, wie ISS diese Schwachstelle einstufen und behandeln werden wird.		09/22/2003	accepted	100
20673	09/22/2003	VulD...	description	Die BlackICE PC Protection (früher unter dem Namen BlackICE Defender bekannt) ist eine hostbasierendes, für Workstations zugeschnittenes Intrusion Detection-System. Die kommerzielle Lösung wird von der Firma Internet Security Systems (ISS) betreut und vertrieben. Die Software verfügt über einen automatisierbaren Update-Mechanismus für die Signaturen und das Produkt ansich. Dafür wird eine HTTP-Verbindung über den TCP-Port 80 zum System http://update.networkice.com hergestellt. In dieser GET-Anfrage werden die grundsätzlichen Daten der Installation übertragen: Lizenznummer und installierte Software-Version. Ist kein neues Update vorhanden, wird auf der rudimentären Webseite der Benutzer darauf hingewiesen. Dabei werden im HTML-Dokument auch die übertragenen Informationen widergegeben. Da keine Sonderzeichen herausgefiltert werden, ist darüber eine Cross Site Scripting Attacke möglich. BlackICE PC Protection erkennt im Normalfall Cross Site Scripting-Zugriffe. Beim Zugriff auf den Update-Server scheint dies jedoch nicht mehr gegeben zu sein. Der technische Support von BlackICE PC Protection wurde am 22. September 2003 um 10:15 Uhr durch das Web-Formular auf die Designschwäche hingewiesen. Als Workaround wird empfohlen, keinen Links zu http://update.networkice.com aus nicht vertrauenswürdiger Quelle zu folgen und bestmöglich Scripting im Webbrowser zu deaktivieren.		09/22/2003	accepted	100
20672	09/22/2003	VulD...	affected	ISS BlackICE PC Protection		09/22/2003	accepted	100
20671	09/22/2003	VulD...	title	ISS BlackICE PC Protection Update Cross Site Scripting		09/22/2003	accepted	100

42 more entries are not shown

🔒 Login Required

You need to signup and login to see more of the remaining 42 results.

◂ Previous Overview Next ▸

Might our Artificial Intelligence support you?

Check our Alexa App!