|
Vulnerability ZoneAlarm Affected ZoneAlarm Description Wally Whacker found following. ZoneAlarm is a very popular personal firewall for Microsoft Windows computers and easy to use for newbies because it is application based, meaning, you apply network permission to applications instead of ports. Because it is application based, Wally was wondering how it handled ports that weren't applications, i.e., what about ports that are opened by the kernel? He tried scanning a ZoneAlarm protected machine using various source ports that are often problems for other firewall environments. What he found was this. If one uses port 67 as the SOURCE port of a UDP scan, ZoneAlarm will let the packet through and will not notify the user. This means, that one can UDP port scan a ZoneAlarm protected computer as if there were no firewall there IF one uses port 67 as the source port on the packets. The version wally tested this on was 2.1.10. It is strongly suspected port 67 needs to be left open because it is used for DHCP. On an earlier version 2.0.26 UDP packets from source port 53 also behaved as above but this doesn't seem to be the case with this latest version. The test was this: 1) Download and install ZoneAlarm version 2.1.10 2) From another computer (unix, linux, etc) run nmap -P0 -p130-140 -sU 192.168.128.88 <-Your Computer Ip Address This will run a small UDP scan on the computer. 3) ZoneAlarm will throw up alarms on these UDP probes 4) NOW, run nmap -g67 -P0 -p130-140 -sU 192.168.128.88 (Notice the -g67 which specifies source port). This will run the same test as above except the packets will have a source port of 67. 5) ZoneAlarm will not throw up any alerts AND if you have any services running on those ports, nmap will find them. Solution The port 67 vulnerability has been eliminated. The upgraded version of ZoneAlarm contains the fix and is available from http://www.zonelabs.com/download_ZA.htm Previously, ZoneAlarm did not prevent TCP or UDP packets from entering the computer through port 67. Port 67 was deliberately left open to avoid instabilities encountered on Windows NT machines using DHCP.