Onderwerp: Unsecure file permission of ZoneAlarm pro.

Hello list,

Zone Alarm stores its config. files in %windir%\Internet Logs\* . But strangely,

ZoneAlarm sets the folder/file permission (NTFS) of %windir%\Internet Logs\* to,

EVERYONE: Full

after its first started.

Even If you try to change the permission to...

Administrator (s): full
system: full
users: read and execute
[these are the default permissions]

Strangely, the permission again changes back to... EVERYONE: Full each time

ZoneAlarm Pro (ZAP) is started. I've tested these in zap 4.x and 5.x

This could prove harmful if we have a malicious program/user running with

even with a user privilege on the system.

Well a malicious program could modify those config file in a way ZAP will stop

functioning. This is what ZoneLabs had to say...

---snip-------
>anyone could open any ZoneAlarm file
> (assuming it isn't locked), edit it with a hexeditor and
> cause it to stop functioning. This type of modification
> wouldn't be classified as an attack, as you have simply
> modified the file and caused it to not function as expected.
> This is true of any executable or other binary.
>
---/snip-------
yap, true... but shouldn’t ZAP have some protection against such attacks? instead

of leaving the permission to " EVERYONE: Full " I wonder if a program could bypass

ZAP filters using "safePrograms*.xml" [...experimenting]

anyone wanna take this thing to a new level, please go on...

Regards,

Bipin Gautam
http://www.geocities.com/visitbipin/

In-Reply-To: <20040820025137.15141.qmail@www.securityfocus.com>

All a trojan/attacker has to do is...

E:\WINDOWS\Internet Logs\> attrib/s +h +s +r +a
{{{ and compress the folder (optional) }}}

Next time, when ZAP or PC restarts... Zone Alarm Pro. so called, TrueVector(r) driver in the kernel will fail to load at all.

regards,
bipin gautam

Bipin, what you're bringing up is a very interesting point.

It turns out that, despite the lax NTFS permissions, the
safePrograms.xml file is apparantly quite well protected from tampering.
The TrueVector driver, which runs kernel-mode, holds a lock on the file
that prevents any other process from modifying it. My observation is
based on ZoneAlarm with AntiVirus 5.1.011.000.

That said, I think that the fundamental question here is still
unanswered. Since you can alter firewall settings via the user-mode
ZoneAlarm client, there must exist a communication channel that the
ZoneAlarm client uses to issue commands to the TrueVector driver. Unless
this channel is properly protected, malware can issue configuration
commands to TrueVector through this same channel.

So my questions are:
* How does the ZoneAlarm client communicate with the TrueVector firewall
driver?
* What prevents malware from pretending to be the ZoneAlarm client and
issuing arbitrary commands to the firewall driver?
* Does the password-protect feature of the ZoneAlarm client have
anything to do with the security on this communications channel?

My guess is that the ZoneLabs people have done their homework and that
all is well. But these are important questions to investigate.

Simon



-----Original Message-----
From: Bipin Gautam [mailto:visitbipin@hotmail.com]
Sent: Thursday, August 19, 2004 9:52 PM
To: bugtraq@securityfocus.com
Subject: Unsecure file permission of ZoneAlarm pro.




Hello list,

Zone Alarm stores its config. files in %windir%\Internet Logs\* . But
strangely,

ZoneAlarm sets the folder/file permission (NTFS) of %windir%\Internet
Logs\* to,

EVERYONE: Full

after its first started.

Even If you try to change the permission to...

Administrator (s): full
system: full
users: read and execute
[these are the default permissions]

Strangely, the permission again changes back to... EVERYONE: Full each time

ZoneAlarm Pro (ZAP) is started. I've tested these in zap 4.x and 5.x

This could prove harmful if we have a malicious program/user running with

even with a user privilege on the system.

Well a malicious program could modify those config file in a way ZAP
will stop

functioning. This is what ZoneLabs had to say...

---snip-------
>anyone could open any ZoneAlarm file
> (assuming it isn't locked), edit it with a hexeditor and
> cause it to stop functioning. This type of modification
> wouldn't be classified as an attack, as you have simply
> modified the file and caused it to not function as expected.
> This is true of any executable or other binary.
>
---/snip-------
yap, true... but shouldn’t ZAP have some protection against such
attacks? instead

of leaving the permission to " EVERYONE: Full " I wonder if a program
could bypass

ZAP filters using "safePrograms*.xml" [...experimenting]

anyone wanna take this thing to a new level, please go on...

Regards,

Bipin Gautam
http://www.geocities.com/visitbipin/