SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Firewall)  >   ZoneAlarm Vendors:   Zone Labs
ZoneAlarm Pro Mobile Code Blocking Can Be Bypassed With SSL Connections
SecurityTracker Alert ID:  1010556
SecurityTracker URL:  http://securitytracker.com/id/1010556
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jun 21 2004
Impact:   Host/resource access via network
Exploit Included:  Yes  
Version(s): 5.0.590.015
Description:   Paul Kurczaba reported a vulnerability in ZoneAlarm Pro. A remote user can bypass the Mobile Code blocking feature.

It is reported that the 'Mobile Code' blocking feature does not filter content delivered via SSL-based connections.

Impact:   A remote user can bypass the mobile code protection feature by delivering content via HTTPS (SSL).
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.zonelabs.com/ (Links to External Site)
Cause:   State error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability


ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability

http://www.kurczaba.com/securityadvisories/0406214.htm
-------------------------------------------------------------

Vulnerability ID Number:
0406214

Overview:
A vulnerability has been found in the 'Mobile Code' filter in ZoneAlarm Pro

Vendor:
ZoneLabs (http://www.zonelabs.com)

Affected Systems/Configuration:
This test was done on a Windows XP Professional machine, running ZoneAlarm Pro 
5.0.590.015. The Internet Explorer version is 6, with all patches.

Vulnerability/Exploit:
The new version of ZoneAlarm Pro features "Mobile Code" blocking, which blocks potentially 
dangerous web objects such as ActiveX, Java Applets, and certain MIME objects. The filter 
blocks out any "application/*" MIME type. The "Mobile Code" filter integrates with 
Internet Explorer.

Unfortunately, the "Mobile Code" filter does not filter SSL content. A malicious person 
could lure a ZoneAlarm Pro user to a malicious SSL site with dangerous "Mobile Code" 
content; and ZoneAlarm Pro would not filter the "Mobile Code".

Workaround:
None so far.

Date Discovered:
June 21, 2004

Severity:
Medium

Credit:
Paul Kurczaba
Kurczaba Associates
http://www.kurczaba.com/
Visit http://www.kurczaba.com for mailing lists in Security, Encryption, Wireless, 
MS-Security, and Production Security.


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC