full-disclosure - Different Claims by ZoneLabs on the "Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20051003181537.03C0C7ED@lists.grok.org.uk>
Date: Mon Oct  3 19:15:44 2005
From: mail at hackingspirits.com (Debasis Mohanty)
Subject: Different Claims by ZoneLabs on the "Bypassing
	PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue

>> Paul Laudanski
>> What I'm saying is that the vendor never claimed ZAP versions prior to 5
are not vulnerable in the report.  

Funny Paul!! You are simple exaggerating upon the same point again and again
in a new style each time. Well, They don't even say that ZAP versions prior
to v5 are vulnerable in their advisory. 

Can you say Product X Pro is un-affected to a particular vulnerability while
Product X (ver 4x / 5x ..) are vulnerable.. NO ! The statement is not
specific and will keep the customers/users clueless whether or not their
firewall version is weak.. The vendor needs to be specific here saying which
versions of Product X Pro is un-affected and which are not.

You many also like to read the ZA user's comments on this issue posted at
Zone Labs's user forum - 
http://forums.zonelabs.com/zonelabs/board/message?board.id=security&message.
id=13104#M13104

Its really funny to see that the vendor wants to keep their EGO up-2-date by
covering up this issue with their latest version 6.0 =))

Gud Luck !! 

-D

-----Original Message-----
From: Paul Laudanski [mailto:zx@...tlecops.com] 
Sent: Monday, October 03, 2005 9:06 PM
To: Debasis Mohanty
Cc: 'Zone Labs Security Team'; bugtraq@...urityfocus.com;
full-disclosure@...ts.grok.org.uk
Subject: RE: [Full-disclosure] Different Claims by ZoneLabs on the
"Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue

On Mon, 3 Oct 2005, Debasis Mohanty wrote:

> Paul,
> 
> >> This does not include the version 3.7.159 you are testing.  
> 
> Didn't get the meaning by what you mean by "This does not include". Do 
> u mean whether or not version 3.7.159 is vulnerable it shouldn't be 
> conscidered??

What I'm saying is that the vendor never claimed ZAP versions prior to 5 are
not vulnerable in the report.  So you're comment is redundant.  Simply
upgrade your version.  Ciao.

--
Paul Laudanski, Microsoft MVP Windows-Security CastleCops(SM),
http://castlecops.com