ZoneLabs ZoneAlarm MailSafe Extension Dot Filtering Bypass Vulnerability

Bugtraq ID:	4407
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 02 2002 12:00AM
Updated:	Apr 02 2002 12:00AM
Credit:	Discovered by Edvice Security Services <[email protected]>.
Vulnerable:	Zone Labs ZoneAlarm 3.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:

ZoneLabs ZoneAlarm MailSafe Extension Dot Filtering Bypass Vulnerability

ZoneLabs ZoneAlarm is a firewall for Microsoft Windows based PCs. It supports a wide range of functions, including a MailSafe feature designed to block email containing malicious content or attachments.

A vulnerability has been reported in some versions of ZoneAlarm. MailSafe may be configured to block file attachments with a certain extension, for example all .exe files. If the same file is sent with an additional '.' appended to the filename, it will not be blocked.

ZoneLabs ZoneAlarm MailSafe Extension Dot Filtering Bypass Vulnerability

No exploit is required.

ZoneLabs ZoneAlarm MailSafe Extension Dot Filtering Bypass Vulnerability

Solution:
Reportedly, ZoneLabs has resolved this issue. Customers are advised to use the product's Check for Update feature.

ZoneLabs ZoneAlarm MailSafe Extension Dot Filtering Bypass Vulnerability

References:

• Zone Labs Homepage (Zone Labs)