Full Disclosure mailing list archives
RE: Unsecure file permission of ZoneAlarm pro.
From: "Todd Towles" <toddtowles () brookshires com>
Date: Fri, 20 Aug 2004 08:07:04 -0500
Sounds like it about as easy to shutdown as Microsoft's SP2 firewall... Overwrite a file, it fails integrity checks and the firewall will fail closed. There is something to add to a dropper program. -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Maarten Sent: Friday, August 20, 2004 7:54 AM To: full-disclosure () lists netsys com Subject: Re: [Full-disclosure] Unsecure file permission of ZoneAlarm pro. On Friday 20 August 2004 12:40, John LaCour wrote:
There is absolutely no security issue here. ZoneAlarm does not rely on file permissions to protect any configuration files. Configuration files are protected by our TrueVector(r) driver in the kernel.
Which is, of course, completely utterly infallible so any additional means are not only unneccessary, but even unwanted.
In addition to protecting configuration files against unauthorized changes, there are additional integrity checks and other protection mechanisms implemented for all policy configuration files. Should any
policy configuration files fail integrity checks, the firewall will fail closed.
So effectively, you're unlocking the car doors because it is equipped with a series of alarmsystems. And even if the owner locks the car doors manually, upon activation, the alarm system unlocks them again ?
Again, no issue.
You must have a screw loose somewhere. Seriously. Maarten _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Unsecure file permission of ZoneAlarm pro., (continued)
- Re: Unsecure file permission of ZoneAlarm pro. stephane nasdrovisky (Aug 21)
- Re: Unsecure file permission of ZoneAlarm pro. James Tucker (Aug 21)
- Re: Unsecure file permission of ZoneAlarm pro. (ZA will fail to load) bipin gautam (Aug 22)
- Re: Unsecure file permission of ZoneAlarm pro. (ZA will fail to load) Chris Smith (Aug 23)
- Re: Unsecure file permission of ZoneAlarm pro. (ZA will fail to load) James Greenhalgh (Aug 23)
- Re: Unsecure file permission of ZoneAlarm pro. (ZA will fail to load) Barrie Dempster (Aug 23)
- Re: Unsecure file permission of ZoneAlarm pro. (ZA will fail to load) Barrie Dempster (Aug 23)
- Re: Unsecure file permission of ZoneAlarm pro. (ZA will fail to load) bipin gautam (Aug 23)
- Re: Unsecure file permission of ZoneAlarm pro. stephane nasdrovisky (Aug 21)
- Re: Unsecure file permission of ZoneAlarm pro. (ZA will fail to load) bipin gautam (Aug 22)
- Re: Unsecure file permission of ZoneAlarm pro. (ZA will fail to load) bipin gautam (Aug 22)
- Re: Unsecure file permission of ZoneAlarm pro. Barry Fitzgerald (Aug 20)
- RE: Unsecure file permission of ZoneAlarm pro. Ron DuFresne (Aug 20)