CVE-2004-0362
HighPublic exploitMultiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a…
Published Apr 15, 2004 · Updated Apr 15, 2026
Key Facts
Patch immediately- CVE-2004-0362 is a high-severity vulnerability (CVSS 7.5 v2) affecting Blackice Agent Server (Iss), Blackice Pc Protection (Iss), Blackice Server Protection (Iss) and 8 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 73% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
73%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2004-0362 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.
Affected Products
109 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Blackice Agent ServerIss | 3.6ebz, 3.6eca, 3.6ecb, 3.6ecc, 3.6ecd, 3.6ece, 3.6ecf | n/a |
| Blackice Pc ProtectionIss | 3.6cbz, 3.6cca, 3.6ccb, 3.6ccc, 3.6ccd, 3.6cce, 3.6ccf | n/a |
| Blackice Server ProtectionIss | 3.6cbz, 3.6cca, 3.6ccb, 3.6ccc, 3.6ccd, 3.6cce, 3.6ccf | n/a |
| Realsecure DesktopIss | 3.6ebz, 3.6eca, 3.6ecb, 3.6ecd, 3.6ece, 3.6ecf, 7.0eba, 7.0ebf | n/a |
| Realsecure GuardIss | 3.6ebz, 3.6eca, 3.6ecb, 3.6ecc, 3.6ecd, 3.6ece, 3.6ecf | n/a |
Timeline
Publicly disclosed
Apr 15, 2004
Last updated
Apr 15, 2026
References
- patchVU#947254
- patch9913
- patch20040318 Vulnerability in ICQ Parsing in ISS Products
- exploitMSF blackice_pam_icq.rb
- exploitExploitDB-16464
FAQ
Common Questions.
Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_U…
Affected: Blackice Agent Server (Iss) versions 3.6ebz, 3.6eca, 3.6ecb, 3.6ecc, 3.6ecd, 3.6ece, 3.6ecf; Blackice Pc Protection (Iss) versions 3.6cbz, 3.6cca, 3.6ccb, 3.6ccc, 3.6ccd, 3.6cce, 3.6ccf; Blackice Server Protection (Iss) versions 3.6cbz, 3.6cca, 3.6ccb, 3.6ccc, 3.6ccd, 3.6cce, 3.6ccf, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2004-0362 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo