[NT] ZoneAlarm Pro Denial of Service Vulnerability

From: support@securiteam.com
Date: 10/17/02 

From: support@securiteam.com
To: list@securiteam.com
Date: 17 Oct 2002 00:35:11 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  ZoneAlarm Pro Denial of Service Vulnerability
------------------------------------------------------------------------

SUMMARY

ZoneAlarm Pro contains vulnerability that would allow an attacker to
consume all CPU and Memory usage resulting in a Denial of Service Attack,
this is done by sending multiple SYN packets (synflooding).

DETAILS

Vulnerable systems:
 * Zone-Labs ZoneAlarm Pro 3.1.291 and 3.0

ZoneAlarm Pro contains vulnerability that would allow an attacker to
consume all CPU and Memory usage resulting in a Denial of Service Attack,
this is done by sending multiple SYN packets. This attack would cause the
machine to no longer respond.

Tested architecture:
[UNIX BOX with IP Spoofing scanner / Flooder] <===[10/100mbps switch===>
[Host with ZoneAlarm]

1] Tested under the default installation, after sending minimum of 300 SYN
packets to port 1-1024 the machine will freeze until the attack is
stopped.

2] Configuring ZoneAlarm firewall to the "BLOCK ALL" traffic setting
appears to have no effect on the vulnerability.

Workaround:
Disable ZoneAlarm and harden the TCP/IP stack of your windows and Install
latest Security patch.

ADDITIONAL INFORMATION

The information has been provided by <mailto:sunninja@scientist.com>
Abraham Lincoln from NSSI Technologies Inc Research Labs.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages