lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <8D8863BB65A02F47A303E5B7666126710152F3DA@exmb1.zonelabs.com>
From: jlacour at zonelabs.com (John LaCour)
Subject: Unsecure file permission of ZoneAlarm pro.

 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

There is absolutely no security issue here.

ZoneAlarm does not rely on file permissions to protect
any configuration files.   Configuration files are protected 
by our TrueVector(r) driver in the kernel. 

In addition to protecting configuration files against 
unauthorized changes, there are additional integrity checks and other
protection mechanisms implemented for all policy configuration 
files.  Should any policy configuration files fail integrity
checks, the firewall will fail closed.

Again, no issue.

- --
John LaCour
Security Services Group Manager
Zone Labs LLC, A Check Point Company




> From: bipin gautam [mailto:visitbipin@...oo.com] 
> Sent: Thursday, August 19, 2004 7:51 PM
> To: full-disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] Unsecure file permission of ZoneAlarm
> pro.  
> 
> 
> Hello list,
> 
> Zone Alarm stores its config. files in
> %windir%\Internet Logs\* . But strangely, 
> 
> ZoneAlarm sets the folder/file permission (NTFS) of 
> %windir%\Internet Logs\* to,
> 
> EVERYONE: Full 
> 
> after its first started.
> 
> Even If you try to change the permission to...
> 
> Administrator (s): full
> system: full
> users: read and execute
> [these are the default permissions] 
> 
> Strangely, the permission again changes back to...
> EVERYONE: Full each time 
> 
> ZoneAlarm Pro (ZAP) is started. I've tested these in
> zap 4.x and 5.x
> 
> 	This could prove harmful if we have a malicious
> program/user running with 
> 
> even with a user privilege on the system.
> 
> Well a malicious program could modify those config
> file in a way ZAP will stop 
> 

[snip]

> Bipin Gautam

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQA/AwUBQSXVCqeZbSyAsADEEQK9fgCeLLipKBn3Z7+PYj1E6GXkT0lubIgAnjCY
ssK9UOJxQn98yj/5x+tWiPzw
=OdxT
-----END PGP SIGNATURE-----


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ