republican-creole
Search:  

 
theme to black backgroundlet page decide theme
HomeFind ServiceReviewsISP NewsFAQsForumsToolsDatabaseAbout 
 
   News
newer
story category Zone Labs Pulls 180
Will fix free software vulnerability after all
(old news - 06:21PM Thursday Jul 03 2003)
tags: security
After claiming the company wouldn't fix a hole in its popular software firewall earlier this week, the company has apparently changed their mind. After discussions sprang up around the web debating the company's integrity, Zone Labs agreed to patch the Windows oriented vulnerability in their free ZoneAlarm firewall software. According to a post made to the Bugtraq mailing list Wednesday night, "Zone Labs will make a fix for its free ZoneAlarm product available in the next two weeks."

"In the meantime," the post states, "users of ZoneAlarm should keep in mind the following facts. This vulnerability has not been exploited to our knowledge. This vulnerability requires that a malicious application is running on the affected PC. For this to occur, an attacker would have to break through the other protection layers of ZoneAlarm (firewall, stealth mode etc.) as a first step."

Related:
  1. Uh, Mom? The Air Force Just Attacked Our PC
  2. T-Mobile Systems Hacked?
  3. Cyber-Attack On U.S. Larger Than Previously Believed
  4. Japanese Computer Scientists Crack WPA
  5. No, Obama Isn't Taking Over The Internets
  6. Comcast Employs New Botnet Alert System
  7. Time Warner Cable Security Flaw Exposes 65,000
  8. Hackable Time Warner Cable Modems Still Hackable?
Forums » Zone Labs Pulls 180
view: topics flat text 
Post a:

Mike
Premium,Mod
join:2000-09-17
Pittsburgh, PA
clubs:

hmmm

Well if they get trolled on slashdot, here, CNN, and I think fark... yeah, you might want to fix that.
permalink · 2003-07-03 17:18:59 · Reply to this
Surfrat

join:2003-06-29
Daytona Beach, FL

Wise Choice

I think that Zone Labs is now making a very good choice here. I for one think that this shows the quality and support of this company. The fact that this FREE program works so well and is fairly frequently updated speaks volumes about the company. Good move Zone, you get an A in my book.
permalink · 2003-07-03 17:30:43 · Reply to this

gdm
Premium,MVM
join:2001-06-15
Mchenry, IL
clubs:

Re: Wise Choice

I don't think they had a choice. Look at the response they got for saying they wouldn't do it.

They should have done the patch in the first place.
permalink · 2003-07-03 17:34:43 · Reply to this

devrandom
I got a pot, full of random stuff here
Premium
join:2003-06-28

Re: Wise Choice

I've been recommending Zone Alarm to like everybody that I can think of (and just recently Sygate).

So yeah, good save ZA. Maybe now you have more publicity and can sell more ZA Pro editions..instead of clipping the free versions .
--
Ask a question. Any question. Well not any.
[text was edited by author 2003-07-03 18:50:19]
permalink · 2003-07-03 18:47:28 · Reply to this

IGGY
No Guru Just Here To Help
Premium,MVM
join:2001-03-30
Chatham, IL

More news to be added to this just in

"In the course of running through test cases regarding the “shell exploit” issue that was posted to BugTraq, we’ve found an issue with ZoneAlarm Plus and ZoneAlarm Pro that we’re fixing. While the theoretical exploit is still blocked under most conditions, there is an increased vulnerability if Internet Explorer is already open. We’ve already coded a fix for this, and our preliminary internal tests indicate that the code is stable. We should be able to release new versions of ZoneAlarm Plus and ZoneAlarm Pro some time in the next couple of weeks."
--
Test Your Security Team Z Member Cable Modem Diagnostics InsightBB 3000/384 XP PRO
permalink · 2003-07-03 17:40:17 · Print · Reply to this
B
Premium,MVM
join:2000-10-28

Re: More news to be added to this just in

Yep. For the record, DSLR's own "jdong" coded a simple exploit and revealed this additional vulnerability in ZA Pro a day or two ago...

-- B
permalink · 2003-07-03 17:55:57 · Reply to this

Smokey
Even drunk on a bet ya make it to Canada
Premium
join:2003-05-20
Va Beach
clubs:
·Cox HSI

 Good m8, Thats why i got ZA, because of its free software. Thats also why i updated to get the pro Za because I thought that Zone Labs would stand behind there products like no other. I glad to see that they are making this fix, as it would have made me lose trust in ZA, and ZoneLabs
--
If there is any realistic deterrent to marriage, it's the fact that you can't afford divorce. -- Jack Nicholson
permalink · 2003-07-03 17:58:49 · Reply to this

MetalManiac7

join:2002-10-12
Artesia, CA

Re: More news to be added to this just in



Concur! This is exactly why I upgraded to PRO.
Because I knew they would take care of any holes in their product. The free version is probably one of the best freebies on the net.
permalink · 2003-07-03 21:48:58 · Reply to this

Brianv5
Low Level Functionary
Premium
join:2001-01-20
Keyser, WV

Reason for change? Bad PR!

I believe this is known as "backpeddling". I mean if youre going to fix it in other products, why not all of them? Oh, that's right, no one pays for this one.. DOH!
--
Anything can be tweaked!
permalink · 2003-07-03 17:56:44 · Reply to this

kilingspam

join:2001-04-30
San Jose, CA

If they didn't, someone would have!

I am glad to see they are gong to 'patch' the problem.
I give them credit for shelling out the money to do it.
I would say $2,500 to $4,000 total. Time and money to develop, package, and distribute the patch. Most of the monies going to bandwidth costs from extra web site traffic of people looking for the patch at their web site and downloading it. (All depending on it's size.)

Wondering though if there are any 'catches' in getting it.
Like having to pony-up an email address for spam, etc.
(can't trust them 100% right now)

But

I also think some damage has been done to their reputation.
To say "OUR product still works fine it's your OS to blame for a hole 'BUT' if you pay for our other offerings it fixes it", was a real lamer attempt to sell their software.

Your products either work or they don't. Freeware, shareware, whatever. Even more so in this case as it is security related.

Side Note: We all know even if they didn't create/offer a patch someone would have made one within a few weeks anyway.
Their user base is large enough to contain several creative people to produce/distribute one themselves.
permalink · 2003-07-03 18:14:14 · Print · Reply to this

misdirected

@adelphia.net

Re: If they didn't, someone would have!

M$ should be held lible for most all security issues today, not ZA, why is it all possible in the first place....

i rest my case, 200 patches, sheesh....
permalink · 2003-07-03 18:34:54 · Reply to this

YaOkThen

@mindspring.com

Re: If they didn't, someone would have!

Let's hold all the companies that distribute Linux responsible for all the security holes in their products too then.

I get at least 4-5 emails a WEEK from the RHN telling me to download this patch or that to fix a security hole.
permalink · 2003-07-03 18:57:13 · Reply to this
bmn
? ? ?
Premium,ExMod 2003-06
join:2001-03-15
hiatus

Re: If they didn't, someone would have!

Ditch Linux and get a BSD... The BSD I'm using needs so few patches that I often forget to even check in the one to two month span between patches.
--
Ditch MSIE... Get a REAL BROWSER
permalink · 2003-07-03 20:38:41 · Reply to this
justed

join:2003-06-23

- fill in blank here -


Alternate viewpoint: It was the ability of the Internet and its users “slashdot, here, CNN, and I think fark” to make clear the importance of resolving this vulnerability.

(If only other organizations – fill in blank here – were as sensitive to the people.)

.
permalink · 2003-07-03 19:02:58 · Reply to this
damox
Premium
join:2002-01-07
Olympia, WA
·Comcast Formerly ..

I'm Impressed

Good call on the part of Zone Alarm. Even though the hole is purportedly a result of a problem with the Windows OS, it is ZA's problem nevertheless. The purpose of Zone Alarm is to provide security, if that security is easily defeated, then it renders the product worthless. Sure enough, either the problem didn't exist in the "paid for" version, or they patched the problem in that product, and so some felt that ZA shouldn't have to patch their free version, and they shouldn't! However, if they want to endear themselves to the public, patching their free product, at least in my opinion, is worth far more than forcing users of their free products to upgrade.

I personally no longer use a software firewall, simply because I find them too much of a hassle, instead I use the combo of a hardware firewall, an anti-virus product, and an anti-Trojan product. I am currently evaluating an anti-worm program as well.

permalink · 2003-07-03 19:30:21 · Print · Reply to this

Greenwar

@170.proxycache

Yeah: I'm Impressed

I´ve just added an anti-freeze-coat to my system :X
permalink · 2003-07-05 18:36:31 · Reply to this

Random Nut
Premium
join:2002-11-29
Mosh Pit

Good job ZA

I will now comeback as a faithful customer.
permalink · 2003-07-03 20:16:32 · Reply to this

hairballman

@cgocable.net

Re: Good job ZA

wait.. you un-installed ZA b/c they wouldn't patch an insignificant vulnerability for the free version of ZA? (that they are already nice enough to provide to the cheap-o's) Are you going back as a faithful ZA pro user (they will offer a patch) or you going to re-install the free version.

I guess you will comeback as a faithful user of their free product until they decide to do something minor that gets huge negative publicity from places like CNN? ZA is lucky to have you as a user (not customer) of their software!

No offence but you are either clueless or you are a real good example of how media are able to take something not even worth being on TV into something that gets the goobers affraid and bashing ZA because CNN tells them to.

Sorry to troll but your just clueless..
permalink · 2003-07-03 22:57:26 · Print · Reply to this

Random Nut
Premium
join:2002-11-29
Mosh Pit

Re: Good job ZA

Actually i was just joking hairballman and if anyones clueless, it's got to go to hairballman. congrats ya #@$#
permalink · 2003-07-03 23:33:17 · Reply to this

Theo2002

join:2002-02-28
Clermont, FL

Oh well

Too bad I've switched to Norton Internet Security.
permalink · 2003-07-03 23:39:36 · Reply to this

aztecnology
O Rly?
Premium
join:2003-02-12
Murrieta, CA
·Verizon FIOS

Re: Oh well

said by Theo2002 See Profile:
Too bad I've switched to Norton Internet Security.
Too bad for you that NIS is an inferior product...
--
.:|:. Tell a man there are 300 billion stars in the universe and he'll believe you. Tell him a bench has wet paint on it and he'll have to touch it to be sure.
permalink · 2003-07-08 18:11:22 · Reply to this

Da22in
Buck Fush

join:2002-06-10
Charlotte, NC
clubs:

Faith restored

Excellent decision on their part. I was disturbed to hear my long trusted software firewall had a hole...even if a small one. Thanks ZL.
...and...
Happy 4th of July!
permalink · 2003-07-04 00:20:56 · Reply to this

Cool Dude
Don't Sweat The Small Stuff

join:2000-08-11
Erie, PA
clubs:

Nice Move Indeed!

Yea, nice move on their part to sell more software.
--
You wana dance you gotta pay the band, you wantna borrow you gota pay the man!
permalink · 2003-07-04 08:49:52 · Reply to this

Da22in
Buck Fush

join:2002-06-10
Charlotte, NC
clubs:

Re: Nice Move Indeed!

I think they realized after the fact that they were f'ing up by leaving a known vulnerability un-fixed....thereby alienating the customer base.
permalink · 2003-07-04 11:25:49 · Reply to this

Theo2002

join:2002-02-28
Clermont, FL

microsoft

Microsoft did the same with older versions of OS. No support.
permalink · 2003-07-04 13:50:44 · Reply to this

Delta 46
Premium
join:2003-03-08
USA

No need functionally? Big need PR wise!

I'm not sure how "needed" the patch or fix is given the exposure or danger. Regardless though, they sure needed to respond and fix it for PR reasons! I wonder why they didn't make that their first decision and do it right away as it seems so clear to me?
permalink · 2003-07-04 17:36:08 · Reply to this
openreel36

join:2001-12-25
Augusta, GA

Compatable with Norton?

I like to run several different firewalls for different reasons. The last two times I tried to run ZA with NIS my comp. restarted and went into safe mode and I could not recover it, even after uninstalling ZA I had to reformat my HD twice. Once from an update and another from a download and reinstall attempt. This is on WIN98SE. Any thoughts on that you wish to send me? openreel36@hotmail.com
permalink · 2003-07-04 19:43:37 · Reply to this

Me1

@tiscali.co

Re: Compatable with Norton?

I too had a similar problem.I have Spybot SD + Ad-aware installed and presumed it was these that caused the conflict when I tried to install Norton,already had ZA.
Anyway I gave up and decided that constant malware/spyware and all their nasty incarnations are worse than the risk of something else.But as I have complete stealth now on my comp. and I reguluary check/test for all the other nasties I don't live in dread anymore. Dont forget to back up everything daily.With cheap reliable media it's a two minute job, so to speak, to restore/format if you have to.And if you ever have it's amazing how much stuff you decide you can live without and don't NEED anymore.All that free this and that which you never use now.
permalink · 2003-07-08 16:40:33 · Print · Reply to this
libra66

join:2003-07-02
Leesburg, GA

what happened?

Anyone have any idea why my previous post isn't showing?
permalink · 2003-07-05 17:52:46 · Reply to this
libra66

join:2003-07-02
Leesburg, GA

disabling firewalls/av's

Now that I can see this post. I'll go ahead and re-post my original one. I was wondering if anyone had any idea why some sites won't let you log in or download anything if you have any kind of firewall, pop-up removal, and/or av installed? There's one particular site I go to study my Microsoft courses, and one of the courses required me to disable all these. Isn't this a bit risky?

Thanks!
permalink · 2003-07-06 09:46:09 · Reply to this

aztecnology
O Rly?
Premium
join:2003-02-12
Murrieta, CA
·Verizon FIOS

Re: disabling firewalls/av's

said by libra66 See Profile:
Now that I can see this post. I'll go ahead and re-post my original one. I was wondering if anyone had any idea why some sites won't let you log in or download anything if you have any kind of firewall, pop-up removal, and/or av installed? There's one particular site I go to study my Microsoft courses, and one of the courses required me to disable all these. Isn't this a bit risky?

Thanks!
Yes, is taking Microsoft courses worth the risk...
--
.:|:. Tell a man there are 300 billion stars in the universe and he'll believe you. Tell him a bench has wet paint on it and he'll have to touch it to be sure.
permalink · 2003-07-08 18:17:10 · Print · Reply to this

ANGELIS

@dialsprint.net

Re: disabling firewalls/av's

I don't think this is such a big deal.

The functionality within ZoneAlarm ( ZA ) is ... well....
I would rather not say.

However...
May I suggest Any -"Open Source Firewall"- perhaps ?

Or At-least something more customizable like Sygate personal firewall. ( Witch Also Keeps Extensive Logs )

I would not suggest -Tiny- or anything by there parent or affiliated company(s).

Cheers!
permalink · 2003-07-09 00:14:01 · Reply to this
libra66

join:2003-07-02
Leesburg, GA

firewall issue

Thanks for the info. Any ideas as to why it would be necessary to do so though?
permalink · 2003-07-09 09:30:19 · Reply to this
Forums » Zone Labs Pulls 180

Sunday, 22-Nov 05:07:58 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.