Check Point - Zone Labs Division:
Response to "Weak Default Permissions Vulnerability"

Summary

Zone Labs ZoneAlarm family of products and Check Point=20
Integrity endpoint security client software use the=20
folder "%WINDOWS%\Internet Logs" to store a copy of=20
logging information and the locally stored security=20
policy. Zone Labs security clients do NOT rely upon=20
NTFS file ownership and permissions to protect logging=20
and policy files stored in this folder. Key files=20
are protected by the security client itself. Logging=20
and policy information cannot be altered as the result=20
of weak file ownership or permissions. =20


Details

Zone Labs security clients write logging information=20
to an unprotected file named ZAlog*.txt as a convenient=20
way for the local user to observe recent events. =20
However, all logged events are also stored in another=20
file that is protected.

ZoneAlarm product family users may review the contents=20
of the protected log file with the client user interface.=20

Integrity server collects security client logs from the=20
protected log files at regular intervals. Administrators=20
may review the logged information via the Integrity=20
Administration console. =20

Zone Labs, a Check Point Company, regards the security=20
of our products and services very seriously and responds=20
to all reports of security matters as soon as possible. =20
To contact the Zone Labs product security team, please=20
contact security@zonelabs.com.