NSFOCUS Security Advisory (SA2006-07)
ISS RealSecure/BlackICE MailSlot Heap Overflow Detection Remote DoS Vulnerability
Release Date: 2006-07-27
CVE ID: CVE-2006-3840
Affected systems & software
RealSecure Network Sensor 7.0
Proventia A Series
Proventia G Series
Proventia M Series
RealSecure Server Sensor 7.0
RealSecure Desktop 7.0
BlackICE PC Protection 3.6
BlackICE Server Protection 3.6
Unaffected systems & software
NSFocus Security Team discovered a remote DoS vulnerability in ISS RealSecure/
BlackICE products lines' detection of MailSlot Heap Overflow (MS06-035). By
sending a specific SMB MailSlot packet it's possible to cause DoS in ISS
There is a DoS vulnerability in ISS protection products' detection of SMB_MailSlot_Heap_Overflow
(MS06-035/KB917159). By sending a specific SMB MailSlot packet it's possible
to cause an infinite loop to occur in the detection code, and the ISS product
or even the operating system will stop to respond. For example, for BlackICE
the vulnerability might cause the inerruption of the network traffic,
and an approximately 100% CPU utilization. STOP BlackICE engine will not restore
normal operation. Instead OS restart is required.
This vulnerability can be triggered by a single packet. The establishment of
a real SMB session is not required.
Block ports TCP/445 and TCP/139 at the firewall.
2006.07.24 Informed the vendor
2006.07.25 Vendor confirmed the vulnerability
2006.07.26 ISS has released a security alert and related patches.
For more details about the security alert, please refer to:
ISS has released the following XPUs to fix this vulnerability:
RealSecure Network 7.0, XPU 24.40
Proventia A Series, XPU 24.40
Proventia G Series, XPU 24.40/1.79
Proventia M Series, XPU 1.79
RealSecure Server Sensor 7.0, XPU 24.40
Proventia Server 1.0.914.1880
RealSecure Desktop 7.0 epk
Proventia Desktop 8.0.812.1790/8.0.675.1790
BlackICE PC Protection 3.6 cpk
BlackICE Server Protection 3.6 cpk
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-3840 to this issue. This is a candidate for inclusion in the
CVE list (http://cve.mitre.org), which standardizes names for security problems.
Candidates may change significantly before they become official CVE entries.
Chen Qing of NSFocus Security Team found the vulnerability.
=========THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY
OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESSED OR IMPLIED,
EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO EVENT SHALL NSFOCUS
BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
EVEN IF NSFOCUS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
DISTRIBUTION OR REPRODUCTION OF THE INFORMATION IS PROVIDED THAT THE
ADVISORY IS NOT MODIFIED IN ANY WAY.
NSFOCUS Security Team