ISS BlackICE PC Protection Cross Site Scripting Detection POST/PUT/DELETE/OPTIONS Request privileges management

Summaryinfo

A vulnerability was found in ISS BlackICE PC Protection. It has been declared as critical. Impacted is an unknown function of the component Cross Site Scripting Detection. Such manipulation as part of POST/PUT/DELETE/OPTIONS Request leads to privileges management. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is traded as CVE-2003-5001. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in ISS BlackICE PC Protection (version now known) and classified as critical. Affected by this issue is some unknown processing of the component Cross Site Scripting Detection. The manipulation as part of a POST/PUT/DELETE/OPTIONS Request leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is integrity.

The weakness was shared 06/14/2003 by Marc Ruef with scip AG (Website). The advisory is shared for download at computec.ch. This vulnerability is handled as CVE-2003-5001. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1068. The problem is said to lie in the detection of cross-site scripting vulnerabilities when embedded within various HTTP requests. Specifically, BlackICE does not match cross-site scripting attacks embedded within PUT and DELETE requests. As a result an attacker may be capable of evading intrusion detection while carrying out these attacks against a target system.

A public exploit has been developed by Marc Ruef in HTTP Request and been published immediately after the advisory. The exploit is available at computec.ch. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 11492 (Sambar Server Multiple Script XSS), which helps to determine the existence of the flaw in a target environment. It is assigned to the family CGI abuses : XSS, running in the context r and relying on port 80.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at iss.com. Attack attempts may be identified with Snort ID 1497.

The vulnerability is also documented in the databases at Tenable (11492) and SecurityFocus (BID 7942†). cgisecurity.com is providing further details. The entries VDB-83, VDB-93, VDB-107 and VDB-110 are related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• ISS

Name

• BlackICE PC Protection

License

• commercial

Support

• end of life

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion