Malicious code masquerading as a trusted application could trick a
ZoneAlarm firewall into letting it connect to the Internet, security
experts have warned.
The notice was given on 28 Sept 05 by Debasis Mohanty. Here is the official word from Zone Alarm. This exploit affects the popular default install of Zone Alarm 5.5 and not 6.0.
ZoneAlarm Pro, ZoneAlarm AntiVirus, ZoneAlarm Wireless Security, and
ZoneAlarm Security Suite version 6.0 or later automatically protect
against this attack in the default configuration.
ZoneAlarm
Pro, ZoneAlarm AntiVirus, ZoneAlarm Wireless Security, and ZoneAlarm
Security Suite version 5.5 are protected against this attack by
enabling the “Advanced Program Control” feature.
Check
Point Integrity client versions 6.0 and 5.1 are protected against this
attack by enabling the “Advanced Program Control” feature.
AFFECTED PRODUCTS:
ZoneAlarm free versions lack the “Advanced Program Control” feature and are therefore unable to prevent this bypass technique.
Recommended Actions:
In my oppinion Zone Alarm is still a great product. This is yet
another example of a highly exposed product getting tested to its
limits like every version of Windows and Internet Explorer.
Ready to actually get the RMF/ISSO job?
Go from reading about the Risk Management Framework to doing it — with the full video course, the books, and a community of GRC professionals taught by Bruce Brown (CISSP, CGRC).
Get the RMF ISSO Foundations course → Browse the RMF & GRC books Join the free GRC community
Leave a Reply