CVE-2006-3999

Severity Score

4.6

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

ISS BlackICE PC Protection 3.6.cpj, 3.6.cpiE, and possibly earlier versions do not properly monitor the integrity of the pamversion.dll BlackICE library, which allows local users to subvert BlackICE by replacing pamversion.dll. NOTE: in most cases, the attack would not cross privilege boundaries because replacing pamversion.dll requires administrative privileges. However, this issue is a vulnerability because BlackICE is intended to protect against certain rogue privileged actions.

ISS BlackICE PC Protection 3.6.cpj, 3.6.cpiE, y posiblemente anteriores versiones no monitorizan adecuadamente la integridad de la libreria pamversion.dll BlackICE, lo caul permite a un usuario local "trastornar" BlackICE a través del remplazo de pamversion.dll. NOTA:
en la mayoría de los casos, el ataque no cruzaría límites del privilegio porque substituir pamversion.dll requiere privilegios administrativos. Sin embargo, esta asunto es una vulnerabilidad porque BlackICE intenta proteger en contra de ciertas acciones "ganujas" privilegiadas.

*Credits: N/A

CVSS Scores

NISTv2 4.6

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2006-08-04 CVE Reserved
2006-08-05 CVE Published
2023-03-08 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (3)

URL	Tag	Source
http://securityreason.com/securityalert/1338	Third Party Advisory
http://securitytracker.com/id?1016618	Vdb Entry
http://www.securityfocus.com/archive/1/441829/100/0/threaded	Mailing List

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Iss Search vendor "Iss"		Blackice Pc Protection Search vendor "Iss" for product "Blackice Pc Protection"				3.6cpie Search vendor "Iss" for product "Blackice Pc Protection" and version "3.6cpie"		-		Affected
Iss Search vendor "Iss"		Blackice Pc Protection Search vendor "Iss" for product "Blackice Pc Protection"				3.6cpj Search vendor "Iss" for product "Blackice Pc Protection" and version "3.6cpj"		-		Affected