ZoneAlarm firewall has massive gaping hole

Found on Security News Portal on Wednesday, 18 February 2004
Browse Internet

The extremely popular firewall, ZoneAlarm, has been dealt a nasty blow with a "highly critical" security hole that allows system access to remote users - i.e. the worst possible situation. The hole affects the most recent version of ZoneAlarm - version 4 - and users with the software's update facility turned on were this morning warned to upgrade and asked to download a run a 4.8MB patching file. The vulnerability itself is an unchecked buffer in the fundamental e-mail protocol SMTP. ZoneAlarm's creators Zone Labs warned that sufficiently exploited, "a skilled attacker could cause the firewall to stop processing traffic, execute arbitrary code, or elevate malicious code’s privileges".

Unfortunately ZoneLabs is taking this 'golden opportunity' to extort subscription fees out of the end users. Yes... you need to have a "current annual update and support subscription" when you visit ZoneAlarm's download page for this updated version.

Wait... you have to pay to get a bug fixed? That's quite a new approach. Somehow I doubt this will be the perfect solution to get new customers. Luckily, I use another firewall.