=20
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Zone Labs Security Alert
Zone Labs Anti-virus Engine OLE Processing Issue

Date Published May 24, 2005
Date Last Revised May 24, 2005

Severity High


Overview
=3D=3D=3D=3D=3D=3D=3D=3D

A security vulnerability existed in the anti-virus engine of specific
versions of ZoneAlarm Anti-Virus and ZoneAlarm Security Suite=20
(ZoneAlarm and ZoneAlarm Pro are not affected.)

The vulnerability was caused due to an integer overflow in the Vet=20
anti-virus engine (VetE.dll) when analyzing OLE streams. This can be=20
exploited to cause a heap-based buffer overflow via a specially=20
crafted Microsoft Office document.

Zone Labs has released an updated anti-virus engine for affected=20
products which is automatically applied during the next anti-virus=20
update, which typically occurs daily. Customers may also manually=20
update their anti-virus service for immediate protection.

Zone Labs remains committed to providing our customers with advanced=20
Internet security technologies for PC protection.


Impact
=3D=3D=3D=3D=3D=3D

If successfully exploited, a skilled attacker could cause the=20
firewall to stop processing traffic, execute arbitrary code, or=20
elevate malicious code's privileges.

Zone Labs recommends affected users update their anti-virus engine=20
and definitions to the current versions which address the issue.
=20
Affected Products
* ZoneAlarm Anti-virus and ZoneAlarm Security Suite

Unaffected Products
* ZoneAlarm and ZoneAlarm Pro
* Check Point Integrity clients and Integrity Server=20
* Integrity Clientless Security products


Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

ZoneAlarm Anti-Virus and ZoneAlarm Security Suite use the Vet engine=20
from Computer Associates for anti-virus detection. Due to an=20
integer wrap issue in the code associated with OLE processing, a=20
heap overflow may occur which could potentially allow a skilled
attacker=20
to cause the firewall to stop processing traffic or execute arbitrary
code.=20


Recommended Actions
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D

ZoneAlarm Anti-virus and ZoneAlarm Security Suite users should=20
upgrade the anti-virus engine to version 11.9.1 or later.

To update your ZoneAlarm Anti-virus or Security Suite product:

1. Select Antivirus

2. In the Status area, choose the Update Now option

3. Select Overview | Product Info and verify that the Antivirus
Vet engine version is 11.9.1 or higher


Related Resources
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D

Zone Labs Security Services: http://www.zonelabs.com/security


Acknowledgments
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Zone Labs would like to thank Alex Wheeler for reporting this issue=20
to Zone Labs.


Contact
=3D=3D=3D=3D=3D=3D=3D

Zone Labs customers who are concerned about this vulnerabilities or
have additional technical questions may reach our Technical Support
group at: http://www.zonelabs.com/support/ =20

To report security issues with Zone Labs products contact:
security@zonelabs.com. Note that any other matters sent to this=20
email address will not receive a response.

Disclaimer:=20
The information in the advisory is believed to be accurate at the=20
time of publishing based on currently available information. Use=20
of the information constitutes acceptance for use in an AS IS=20
condition. There are no warranties with regard to this information.=20
Neither the author nor the publisher accepts any liability for any=20
direct, indirect, or consequential loss or damage arising from use=20
of, or reliance on, this information. Zone Labs and Zone Labs=20
products, are registered trademarks of Zone Labs LLC and/or=20
affiliated companies in the United States and other countries.=20
All other registered and unregistered trademarks represented in=20
this document are the sole property of their respective
companies/owners.

Copyright:=20
(c)2005 Zone Labs LLC All rights reserved. Zone Labs, TrueVector,=20
ZoneAlarm, and Cooperative Enforcement are registered trademarks=20
of Zone Labs LLC. The Zone Labs logo, Check Point Integrity and=20
IMsecure are trademarks of Zone Labs, Inc. Check Point Integrity=20
protected under U.S. Patent No. 5,987,611. Reg. U.S. Pat. & TM Off.=20
Cooperative Enforcement is a service mark of Zone Labs LLC All other=20
trademarks are the property of their respective owners.

Any reproduction of this alert other than as an unmodified copy of=20
this file requires authorization from Zone Labs. Permission to=20
electronically redistribute this alert in its unmodified form is=20
granted. All other rights, including the use of other media, are=20
reserved by Zone Labs LLC.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQpSdxVDxXw2Is3mLEQIvJwCcC5EsnbBQ+QWVaUZBdXh0o1 zBMkkAoIxg
2nXt1uCFFTGXjZlahfemO6PI
=3D0Ubb
-----END PGP SIGNATURE-----