ZoneAlarm E-mail Security Can Be Bypassed By Remote Users
|
|
SecurityTracker Alert ID: 1009822
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 15 2004
|
Impact: Host/resource access via network
|
Exploit Included: Yes
|
Description: A vulnerability was reported in ZoneAlarm in the e-mail protection feature. A remote user can send specially crafted attachments to bypass the security feature.
Damjan Kreft reported that a remote user can send an e-mail message containing an attachment with certain characters in the filename
to cause the software to fail to properly quarantine the file.
The characters are three specific characters in the Solvenia alphabet.
The
vendor has reportedly been notified without response.
|
Impact: A remote user can send an e-mail attachment that will not be quarantined.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.zonelabs.com/ (Links to External Site)
|
Cause: Access control error, Input validation error, State error
|
Underlying OS: Windows (Any)
|
Reported By: "Damjan Kreft" <damjan.kreft@siol.net>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 14 Apr 2004 22:44:50 +0200
From: "Damjan Kreft" <damjan.kreft@siol.net>
Subject: ZA Security Hole
|
Hello!
I think, I discover some kind of security hole in ZoneAlaram - any version.
The problem is hidding in E-mail Protection. Because I'm form Slovenia (not
Slovakia), our alphabet does have some letters with roof (c - è, s - ¹, z -
¾). And when the name of e-mail attachment contain any of these three
letters, it don't go to the qurarantine (if the attachment do have right
extension of course). I think that can be security threat. From this reason
I write to you. If this is mistake, I'm sorry to steal your time with this
e-mail. And sorry for my bad english :)
I write to ZA Labs too, but no answer.
Greets, Damjan
_____________ NOD32 Information _____________
This message was checked by NOD32 antivirus system.
http://www.nod32.com
__________________________________________
|
|
