Black ICE 3.1eaj Ping Flood Denial of Service Bypass

Subject: Black ICE Ping Vulnerability Side Note From: Stoic forty-four Date: 2002-02-06 17:24:57 Key Information: Vulnerability Discovered: An issue identified related to the Black ICE Ping Vulnerability while attempting to replicate an attack described by Matt Taylor. Outcome: Instead of a large ping causing the server to blue screen or hang the Black ICE service, the service was actually stopped, thereby allowing potential intruder access to the host. Test Configuration: - Black ICE Agent Version: 3.1eaj - ICE CAP Version: 3.1 - Operating System: Windows 2000 SP2 on a Dell 6450 - Other Software: WinVNC 3.3 server in application mode - Black ICE Settings: Paranoid mode to prevent inbound connections Testing Process: - Initial VNC connection attempt was blocked. - Command executed: . - After waiting 5 seconds, a successful VNC connection was established. Observations: - Upon connecting via VNC and accessing the desktop, a Black ICE pop-up appeared indicating that the Black ICE service had stopped and asked whether the service should be restarted. - Restarting the service was successful, but the VNC session remained active. - No logs were recorded in Black ICE indicating that the event had occurred. Impact: This vulnerability likely affects enterprises that have deployed Black ICE agents and ICE CAP infrastructure, enabling remote access to the system under certain conditions without generating any log entries. Author: Brandon Young Note: The author expresses interest in knowing if others can replicate this finding.

Goal Reached Thanks to every supporter — we hit 100%!

Black ICE 3.1eaj Ping Flood Denial of Service Bypass