Hash: SHA1

             AUSCERT External Security Bulletin Redistribution

                ESB-2006.0518 -- [Win][Linux][Solaris][AIX]
       Protocol Parsing Bug in SMB Mailslot Parsing in ISS Products
                               28 July 2006


        AusCERT Security Bulletin Summary

Product:              RealSecure Network/Server/Desktop Sensor 7.0
                      Proventia A/G/M Series
                      Proventia Server and Desktop
                      BlackICE Server and PC Protection 3.6
Publisher:            ISS
Operating System:     AIX
                      Linux variants
Impact:               Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-3840

Original Bulletin:    http://xforce.iss.net/xforce/alerts/id/230

- --------------------------BEGIN INCLUDED TEXT--------------------

Internet Security Systems Security Alert
July 26, 2005

Protocol Parsing Bug in SMB Mailslot Parsing in ISS Products	
Version: 1.0

CVSS Score:

Access Vector: Remote
Access Complexity: High
Authentication: Not Required
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Complete
Impact Bias: Availability
Base Score: 2

Exploitability: Proof of concept
Remediation Level: Official Fix
Report Confidence: Confirmed
Temporal: 1.6


A protocol parsing bug was discovered within ISS July 2006 XPU 
SMB_MailSlot_Heap_Overflow decode.  This decode is designed to provide 
protection for the Microsoft SMB/TCP Mailslot vulnerability (MS06-035), 
but can be adversely affected by certain types of legitimate SMB Mailslot 
network traffic.  In the worst case scenario, some host-based protection 
products will suffer from a denial of service.

Affected Versions:

See knowledgebase article:



The protocol parsing bug is caused by incorrect parsing of SMB/TCP 
Mailslot information. The flaw may be triggered by certain types of 
legitimate SMB Mailslot traffic. ISS X-Force has confirmed that 
exploitation of this issue, which results in remote access, is NOT possible; 
however, it can cause a denial of service.  In the worst case scenario, 
host-based products will loose network connectivity  requiring a host restart. 


ISS July XPUs provided virtual patch protection for Microsofts MS06-035 
vulnerability.  However, a bug in the logic for the virtual patch decode, 
SMB_MailSlot_Heap_Overflow, may be triggered when encountering certain 
types of legitimate SMB Mailslot traffic, which would result in the protocol 
analysis module (PAM) engine not responding to subsequent network 
traffic.  This denial of service is managed differently by each 
ISS product that utilizes PAM.  It is important to note that PAM will 
successfully protect against possible exploit attempts of the SMB 
Mailslot vulnerability (MS06-035).

The default affect of the protocol parsing bug in the ISS protection products 
is dependant upon the protection platform.  An ISS knowledgebase has 
been produced, which details how each protection product handles the 
bug, can be found at:

Mitigating Factors:

* Firewall best practices and standard default firewall configurations 
can help protect networks from attacks that originate outside the enterprise 
perimeter. Best practices recommend that systems that are connected to the 
Internet have a minimal number of ports exposed.  In particular blocking 
TCP port 445 at the firewall will help protect systems that are behind 
that firewall from attempts to exploit this vulnerability.
* Microsoft Windows XP Service Pack 2 and Microsoft Windows Server 2003 
Service Pack 1 do not have services listening on Mailslots in default 


ISS X-Force recommends that customers immediately update to the newest 
XPU provided by ISS. These XPUs contains a fix for this vulnerability.

ISS has already made the following updates available to remedy this

RealSecure Network 7.0, XPU 24.40
Proventia A Series, XPU 24.40
Proventia G Series, XPU 24.40/1.79
Proventia M Series, XPU 1.79
RealSecure Server Sensor 7.0, XPU 24.40
Proventia Server 1.0.914.1880
RealSecure Desktop 7.0 epk
Proventia Desktop 8.0.812.1790/8.0.675.1790
BlackICE PC Protection 3.6 cpk
BlackICE Server Protection 3.6 cpk

Updates are available from the ISS Download Center:

As a temporary workaround while the updates are being applied and as a
general security best-practice, it is recommended that SMB traffic be
blocked at network perimeters.

Additional Information:



ISS X-Force would like to thank the NSFOCUS Security Team for notifying ISS 
of the issue.


About Internet Security Systems, Inc.
Internet Security Systems, Inc. (ISS) is the trusted security advisor to 
thousands of the world's leading businesses and governments, providing 
preemptive protection for networks, desktops and servers. An established 
leader in security since 1994, ISS' integrated security platform 
automatically protects against both known and unknown threats, keeping networks 
up and running and shielding customers from online attacks before they 
impact business assets. ISS products and services are based on the proactive 
security intelligence of its X-Force research and development team - the 
unequivocal world authority in vulnerability and threat research. ISS' 
product line is also complemented by comprehensive Managed Security Services. 
For more information, visit the Internet Security Systems Web site at 
www.iss.net or call 800-776-2362.

Copyright (c) 2006 Internet Security Systems, Inc. All rights reserved

This document is not to be edited or altered in any way without the
express written consent of Internet Security Systems, Inc. If you wish
to reprint the whole or any part of this document, please email 

xforce@iss.net for permission. You may provide links to this document
from your web site, and you may make copies of this document in
accordance with the fair use doctrine of the U.S. copyright laws. 

Disclaimer: The information within this paper may change without notice. 
Use of this information constitutes acceptance for use in an AS IS condition. 
There are NO warranties, implied or otherwise, with regard to this information 
or its use. Any use of this information is at the user's risk. In no event 
shall the author/distributor (Internet Security Systems X-Force) be held 
liable for any damages whatsoever arising out of or in connection with the 
use or spread of this information.

X-Force PGP Key available on MIT's PGP key server and PGP.com's key
server, as well as at http://www.iss.net/security_center/sensitive.php
Please send suggestions, updates, and comments to: X-Force

xforce@iss.net of Internet Security Systems, Inc.


Version 1.0 July 25, 2006 - Initial alert release

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.

Comment: http://www.auscert.org.au/render.html?it=1967