ZoneAlarm Pro Mobile Code Blocking Can Be Bypassed With SSL Connections
|
|
SecurityTracker Alert ID: 1010556
|
|
SecurityTracker URL: http://securitytracker.com/id?1010556
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 21 2004
|
Impact: Host/resource access via network
|
Exploit Included: Yes
|
Version(s): 5.0.590.015
|
Description: Paul Kurczaba reported a vulnerability in ZoneAlarm Pro. A remote user can bypass the Mobile Code blocking feature.
It is reported that the 'Mobile Code' blocking feature does not filter content delivered via SSL-based connections.
|
Impact: A remote user can bypass the mobile code protection feature by delivering content via HTTPS (SSL).
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.zonelabs.com/ (Links to External Site)
|
Cause: State error
|
Underlying OS: Windows (Any)
|
Reported By: Kurczaba Associates advisories <advisories@kurczaba.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 20 Jun 2004 23:08:34 -0400
From: Kurczaba Associates advisories <advisories@kurczaba.com>
Subject: ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability
|
ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability
http://www.kurczaba.com/securityadvisories/0406214.htm
-------------------------------------------------------------
Vulnerability ID Number:
0406214
Overview:
A vulnerability has been found in the 'Mobile Code' filter in ZoneAlarm Pro
Vendor:
ZoneLabs (http://www.zonelabs.com)
Affected Systems/Configuration:
This test was done on a Windows XP Professional machine, running ZoneAlarm Pro
5.0.590.015. The Internet Explorer version is 6, with all patches.
Vulnerability/Exploit:
The new version of ZoneAlarm Pro features "Mobile Code" blocking, which blocks potentially
dangerous web objects such as ActiveX, Java Applets, and certain MIME objects. The filter
blocks out any "application/*" MIME type. The "Mobile Code" filter integrates wit
h
Internet Explorer.
Unfortunately, the "Mobile Code" filter does not filter SSL content. A malicious person
could lure a ZoneAlarm Pro user to a malicious SSL site with dangerous "Mobile Code"
content; and ZoneAlarm Pro would not filter the "Mobile Code".
Workaround:
None so far.
Date Discovered:
June 21, 2004
Severity:
Medium
Credit:
Paul Kurczaba
Kurczaba Associates
http://www.kurczaba.com/
Visit http://www.kurczaba.com for mailing lists in Security, Encryption, Wireless,
MS-Security, and Production Security.
|
|
