Advisories
Zone Labs SMTP Processing Buffer Overflow
Release Date:
February 18, 2004
Date Reported:
February 13, 2004
Patch Development Time (In Days):
Severity:
Medium (Local Privilege Escalation/Remote Code Execution)
Vendor:
ZoneLabs Inc.
Systems Affected:
ZoneAlarm 4.0 to 4.5.538.000
ZoneAlarm Pro 4.0 to 4.5.538.000
ZoneAlarm Plus 4.0 to 4.5.538.000
Zone Labs Integrity Client 4.0 to 4.5.084
Overview:
Zone Labs provides a suite of desktop firewall products. Products in this suite such as ZoneAlarm analyze incoming and outgoing email messages for malicious or otherwise abnormal content. When ZoneAlarm examines outgoing email messages, a buffer overflow condition is presented when it retrieves the destination email address from the message. An attacker can exploit this vulnerability to elevate his privileges to SYSTEM on any machine protected by a vulnerable Zone Labs product. This vulnerability can also be exploited remotely if an attacker can manipulate the protected system into sending an outgoing email message.
Technical Details:
Technical Description:
A stack based buffer overflow vulnerability within vsmon.exe can be exploited to execute code with the context of the SYSTEM account. The vulnerability exists within the component responsible for processing the RCPT TO command argument. By specifying a large argument to the RCPT TO command, an internal stack based buffer can be overflowed within the TrueVector Internet Monitor (vsmon.exe) process.
Protection:
Retina Network Security Scanner has been updated to identify this vulnerability.
Vendor Status:
Within only a few days of being contacted, Zone Labs produced an update to eliminate this vulnerability. We would like to give special recognition to the responsiveness of Zone Labs in creating a fix to protect their customers.
http://download.zonelabs.com/bin/free/securityAlert/8.html
Credit:
Discovery: Riley Hassell
Related Links:
Retina Network Security Scanner - Free 15 Day Trial http://www.eeye.com/html/Products/Retina/download.html
Greetings:
All the other firewall vendors on our list.
Copyright (c) 1998-2009 eEye Digital Security
Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission.
Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.
February 18, 2004
Date Reported:
February 13, 2004
Patch Development Time (In Days):
 |
|
|
|
| 5 |
Severity:
Medium (Local Privilege Escalation/Remote Code Execution)
Vendor:
ZoneLabs Inc.
Systems Affected:
ZoneAlarm 4.0 to 4.5.538.000
ZoneAlarm Pro 4.0 to 4.5.538.000
ZoneAlarm Plus 4.0 to 4.5.538.000
Zone Labs Integrity Client 4.0 to 4.5.084
Overview:
Zone Labs provides a suite of desktop firewall products. Products in this suite such as ZoneAlarm analyze incoming and outgoing email messages for malicious or otherwise abnormal content. When ZoneAlarm examines outgoing email messages, a buffer overflow condition is presented when it retrieves the destination email address from the message. An attacker can exploit this vulnerability to elevate his privileges to SYSTEM on any machine protected by a vulnerable Zone Labs product. This vulnerability can also be exploited remotely if an attacker can manipulate the protected system into sending an outgoing email message.
Technical Details:
Technical Description:
A stack based buffer overflow vulnerability within vsmon.exe can be exploited to execute code with the context of the SYSTEM account. The vulnerability exists within the component responsible for processing the RCPT TO command argument. By specifying a large argument to the RCPT TO command, an internal stack based buffer can be overflowed within the TrueVector Internet Monitor (vsmon.exe) process.
Protection:
Retina Network Security Scanner has been updated to identify this vulnerability.
Vendor Status:
Within only a few days of being contacted, Zone Labs produced an update to eliminate this vulnerability. We would like to give special recognition to the responsiveness of Zone Labs in creating a fix to protect their customers.
http://download.zonelabs.com/bin/free/securityAlert/8.html
Credit:
Discovery: Riley Hassell
Related Links:
Retina Network Security Scanner - Free 15 Day Trial http://www.eeye.com/html/Products/Retina/download.html
Greetings:
All the other firewall vendors on our list.
Copyright (c) 1998-2009 eEye Digital Security
Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission.
Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.
