mailing list archives
RE: Different Claims by ZoneLabs on the "Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue
From: "Debasis Mohanty" <mail () hackingspirits com>
Date: Mon, 3 Oct 2005 23:45:38 +0530
What I'm saying is that the vendor never claimed ZAP versions prior to 5
are not vulnerable in the report.
Funny Paul!! You are simple exaggerating upon the same point again and again
in a new style each time. Well, They don't even say that ZAP versions prior
to v5 are vulnerable in their advisory.
Can you say Product X Pro is un-affected to a particular vulnerability while
Product X (ver 4x / 5x ..) are vulnerable.. NO ! The statement is not
specific and will keep the customers/users clueless whether or not their
firewall version is weak.. The vendor needs to be specific here saying which
versions of Product X Pro is un-affected and which are not.
You many also like to read the ZA user's comments on this issue posted at
Zone Labs's user forum -
Its really funny to see that the vendor wants to keep their EGO up-2-date by
covering up this issue with their latest version 6.0 =))
Gud Luck !!
From: Paul Laudanski [mailto:zx () castlecops com]
Sent: Monday, October 03, 2005 9:06 PM
To: Debasis Mohanty
Cc: 'Zone Labs Security Team'; bugtraq () securityfocus com;
full-disclosure () lists grok org uk
Subject: RE: [Full-disclosure] Different Claims by ZoneLabs on the
"Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue
On Mon, 3 Oct 2005, Debasis Mohanty wrote:
This does not include the version 3.7.159 you are testing.
Didn't get the meaning by what you mean by "This does not include". Do
u mean whether or not version 3.7.159 is vulnerable it shouldn't be
What I'm saying is that the vendor never claimed ZAP versions prior to 5 are
not vulnerable in the report. So you're comment is redundant. Simply
upgrade your version. Ciao.
Paul Laudanski, Microsoft MVP Windows-Security CastleCops(SM),
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/