SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Firewall)  >   ZoneAlarm Vendors:   Zone Labs
(Original Advisory is Available) ZoneAlarm SMTP Buffer Overflow Lets Local and Remote Users Execute Arbitrary Code With SYSTEM Privileges
SecurityTracker Alert ID:  1009140
SecurityTracker URL:  http://securitytracker.com/id/1009140
CVE Reference:   CVE-2004-0309   (Links to External Site)
Updated:  Mar 23 2004
Original Entry Date:  Feb 19 2004
Impact:   Execution of arbitrary code via local system, Execution of arbitrary code via network, Root access via local system, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.0 and above, but prior to 4.5.538.001
Description:   A buffer overflow vulnerability was reported in ZoneAlarm and the Zone Labs Integrity client in the processing of SMTP messages. A remote or local user can execute arbitrary code on the target system.

It is reported that ZoneAlarm, ZoneAlarm Pro, ZoneAlarm Plus, and the Zone Labs Integrity client process an unchecked buffer in the handling of SMTP messages.

A remote user can connect to the target system on TCP port 25 (for systems that are configured in this manner) and send a specially crafted message to trigger the stack overflow and execute arbitrary code with SYSTEM privileges. The flaw reportedly resides in 'vsmon.exe' in the processing of the RCPT TO command.

A local user can also send specially crafted outbound e-mail to triger the flaw.

The vendor reports that the Integrity Server and Integrity Clientless Security products are not affected.

The vendor credits eEye Digital Security with reporting this flaw.

Impact:   A local user or, in cases where the SMTP service is running, a remote user can execute arbitrary code on the target system with SYSTEM privileges.
Solution:   The vendor has released a fixed version (4.5.538.001) of ZoneAlarm, ZoneAlarm Plus, and ZoneAlarm Pro.

The vendor has released a fixed version (4.0.146.046) of the Integrity 4.0 client.

The vendor has released a fixed version (4.5.085) of the Integrity 4.5 client.

See the vendor's advisory for upgrade instructions:

http://download.zonelabs.com/bin/free/securityAlert/8.html

Vendor URL:  download.zonelabs.com/bin/free/securityAlert/8.html (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (Any)

Message History:   This archive entry is a follow-up to the message listed below.
Feb 19 2004 ZoneAlarm SMTP Buffer Overflow Lets Local and Remote Users Execute Arbitrary Code With SYSTEM Privileges



 Source Message Contents

Subject:  EEYE: ZoneLabs SMTP Processing Buffer Overflow


ZoneLabs SMTP Processing Buffer Overflow

Release Date:
February 18, 2004

Date Reported:
February 13, 2004

Severity:
Medium (Local Privilege Escalation/Remote Code Execution)

Vendor:
ZoneLabs Inc.
 
Software Affected:
ZoneAlarm 4.0 and above
ZoneAlarm Pro 4.0 and above
ZoneAlarm Plus 4.0 and above
ZoneLabs Integrity client 4.0 and above

Description:
 
ZoneLabs provides a suite of desktop firewall products. Products in this
suite such as ZoneAlarm analyze incoming and outgoing email messages for
malicious or otherwise abnormal content. When ZoneAlarm examines
outgoing email messages a buffer overflow condition is presented when
they retrieve the destination email address from the message. An
attacker can exploit this vulnerability to elevate his privileges to
SYSTEM on any machine protected by a vulnerable ZoneLabs product. This
vulnerability can also be exploited remotely if an attacker can
manipulate the protected system into sending an outgoing email message.

Technical Description:
 
A stack based buffer overflow vulnerability within vsmon.exe can be
exploited to execute code with the context of the SYSTEM account. The
vulnerability exists within the component responsible for processing the
RCPT TO command argument. By specifying a large argument to the RCPT TO
command an internal stack based buffer can be overflowed within the
TrueVector Internet Monitor (vsmon.exe) process.

Protection:
Retina Network Security Scanner has been updated to identify this
vulnerability.

Vendor Status:
ZoneLabs was contacted and within only a few days they produced an
update to eliminate this vulnerability within their products. We would
like to give special recognition to the responsiveness of ZoneLabs in
creating a fix to protect their customers. 

http://download.zonelabs.com/bin/free/securityAlert/8.html

Credit:
Discovery: Riley Hassell

Related Links:
Retina Network Security Scanner - Free 15 Day Trial
http://www.eeye.com/html/Products/Retina/index.html

Greetings:
All the other firewall vendors on our list.

Copyright (c) 1998-2004 eEye Digital Security Permission is hereby
granted for the redistribution of this alert electronically. It is not
to be edited in any way without express consent of eEye. If you wish to
reprint the whole or any part of this alert in any other medium
excluding electronic medium, please e-mail alert@eEye.com for
permission.

Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties with regard to this information. In no event shall the
author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.

Feedback
Please send suggestions, updates, and comments to:

eEye Digital Security
http://www.eEye.com
info@eEye.com

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC