PT-2006-4415 · Check Point Zone · Zonealarm Internet Security Suite

Published 2006-07-13 · Updated 2018-10-18 · CVE-2006-3540

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Check Point Zone Labs ZoneAlarm Internet Security Suite versions 6.1.737.000, 6.5.722.000

Description The issue arises from improper validation of function calls, specifically RegSaveKey, RegRestoreKey, and RegDeleteKey, which can be exploited by local users to cause a denial of service, resulting in a system crash. This is achieved through a specific combination of these function calls with an argument related to HKEY LOCAL MACHINESYSTEMCurrentControlSetServicesVETFDDNTEnum.

Recommendations For version 6.1.737.000, consider disabling the RegSaveKey, RegRestoreKey, and RegDeleteKey functions as a temporary workaround until a patch is available. For version 6.5.722.000, restrict access to the HKEY LOCAL MACHINESYSTEMCurrentControlSetServicesVETFDDNTEnum registry key to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-3540

Affected Products

Zonealarm Internet Security Suite

References · 5

• http://matousec.com/info/advisories/ZoneAlarm-Insufficient-protection-of-registry-key-VETFDDNT-Enum.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3540 · Security Note
• http://securityfocus.com/archive/1/438970/100/0/threaded · Note
• http://securityfocus.com/bid/18789 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27584 · Note