PT-2004-1704 · Zonealarm · Zonealarm Pro

Published 2004-06-30 · Updated 2017-07-11 · CVE-2004-0612

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ZoneAlarm Pro version 5.0.590.015

Description The issue concerns the Mobile Code filter in ZoneAlarm Pro, which fails to filter mobile code within an SSL encrypted session. This could potentially allow remote attackers to bypass the mobile code filtering. It is noted that the vendor has disputed this behavior, stating it is required by the SSL specification.

Recommendations For ZoneAlarm Pro version 5.0.590.015, consider restricting access to SSL encrypted sessions until a fix is available, or disabling the Mobile Code filter as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2004-0612

Affected Products

Zonealarm Pro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-0612 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2004-06/0420.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16471 · Note
• http://marc.info/?l=bugtraq&m=108786444608208&w=2 · Note
• http://securityfocus.com/bid/10584 · Note