PT-2004-3603 · Zonealarm · Zonealarm Pro

Published 2004-12-31 · Updated 2024-08-08 · CVE-2004-2713

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Zone Alarm Pro versions 1.0 through 5.1

Description The issue allows local users to cause a denial of service by modifying the folder contents or permissions of the %windir%Internet Logs* directory, which is accessible to the EVERYONE group. This gives full access to the directory, potentially disrupting system functionality. Note that the vendor has disputed this issue, claiming it does not affect product functionality since the same information is also saved in a protected file.

Recommendations For Zone Alarm Pro versions 1.0 through 5.1, consider restricting access to the %windir%Internet Logs* directory to prevent local users from modifying its contents or permissions, which could cause a denial of service.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2004-2713

Affected Products

Zonealarm Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-2713 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17099 · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-08/0389.html · Note
• http://osvdb.org/9761 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0871.html · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0933.html · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0883.html · Note