ZoneLabs ZoneAlarm Pro/Plus MailSafe Filter Bypass Vulnerability

Bugtraq ID:	10148
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 14 2004 12:00AM
Updated:	Apr 14 2004 12:00AM
Credit:	Discovery of this vulnerability has been credited to "Damjan Kreft" <[email protected]>.
Vulnerable:	Zone Labs ZoneAlarm Pro 4.5 .538.001 Zone Labs ZoneAlarm Pro 4.5 Zone Labs ZoneAlarm Pro 4.0 Zone Labs ZoneAlarm Pro 3.1 Zone Labs ZoneAlarm Pro 3.0 Zone Labs ZoneAlarm Pro 2.6 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Zone Labs ZoneAlarm Pro 2.4 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Zone Labs ZoneAlarm Plus 4.5 .538.001 Zone Labs ZoneAlarm Plus 4.0
Not Vulnerable:

ZoneLabs ZoneAlarm Pro/Plus MailSafe Filter Bypass Vulnerability

A vulnerability has been reported in some versions of ZoneAlarm Pro/Plus MailSafe. MailSafe may be configured to quarantine file attachments with a certain extension. It is reported that, if the file name of a restricted attachment contains certain extended characters, MailSafe may fail to quarantine the attachment.

ZoneLabs ZoneAlarm Pro/Plus MailSafe Filter Bypass Vulnerability

There is no exploit required.

ZoneLabs ZoneAlarm Pro/Plus MailSafe Filter Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ZoneLabs ZoneAlarm Pro/Plus MailSafe Filter Bypass Vulnerability

References:

• Zone Labs Homepage (Zone Labs)
  
• ZA Security Hole ("Damjan Kreft" )