[NT] ZoneAlarm Pro Denial of Service Vulnerability

From: support@securiteam.com
Date: 10/17/02 

From: support@securiteam.com
To: list@securiteam.com
Date: 17 Oct 2002 00:35:11 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  ZoneAlarm Pro Denial of Service Vulnerability
------------------------------------------------------------------------

SUMMARY

ZoneAlarm Pro contains vulnerability that would allow an attacker to
consume all CPU and Memory usage resulting in a Denial of Service Attack,
this is done by sending multiple SYN packets (synflooding).

DETAILS

Vulnerable systems:
 * Zone-Labs ZoneAlarm Pro 3.1.291 and 3.0

ZoneAlarm Pro contains vulnerability that would allow an attacker to
consume all CPU and Memory usage resulting in a Denial of Service Attack,
this is done by sending multiple SYN packets. This attack would cause the
machine to no longer respond.

Tested architecture:
[UNIX BOX with IP Spoofing scanner / Flooder] <===[10/100mbps switch===>
[Host with ZoneAlarm]

1] Tested under the default installation, after sending minimum of 300 SYN
packets to port 1-1024 the machine will freeze until the attack is
stopped.

2] Configuring ZoneAlarm firewall to the "BLOCK ALL" traffic setting
appears to have no effect on the vulnerability.

Workaround:
Disable ZoneAlarm and harden the TCP/IP stack of your windows and Install
latest Security patch.

ADDITIONAL INFORMATION

The information has been provided by <mailto:sunninja@scientist.com>
Abraham Lincoln from NSSI Technologies Inc Research Labs.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • NSSI-2002-zonealarm3: ZoneAlarm Pro Denial of Service Vulnerability
    ... Subject: NSSI-2002-zonealarm3: ZoneAlarm Pro Denial of Service ... ZoneAlarm Pro 3.1 and 3.0 Denial of Service Vulnerability ... This vulnerability is confirmed by the vendor. ... Denial of Service Attack through sending multiple syn packets / ...
    (comp.security.firewalls)
  • [NT] ISS BlackICE Exploitable Kernel Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... of Service Vulnerability in BlackICE Products. ... Digital Security on the subject revealed that this vulnerability is more ... Service attack that could result in the BlackICE service crashing and or ...
    (Securiteam)
  • Re: NSSI-2002-zonealarm3: ZoneAlarm Pro Denial of Service Vulnerability
    ... > NSSI Technologies Inc Research Labs Security Advisory ... > ZoneAlarm Pro 3.1 and 3.0 Denial of Service Vulnerability ... > ZoneAlarm Pro 3.1 and 3.0 doubles your protection with enhanced Ad ... > would result to Denial of Service Attack through Synflooding that would ...
    (comp.security.firewalls)
  • ZoneAlarm Pro 3.1 and 3.0 Denial of Service Vulnerability
    ... ZoneAlarm Pro 3.1 and 3.0 Denial of Service Vulnerability ... Denial of Service Attack through Synflooding that would cause the machine to ...
    (NT-Bugtraq)
  • Cisco LEAP Insecurities + POC
    ... supposed to offer greater security against malicious threat agents. ... This is a reduction of the complexity for a dictionary attack. ... hacker then don't pretend to be, and don't run security audits. ... vulnerability, or SQL-injection vulnerability. ...
    (Bugtraq)
Quantcast