Detections
Analytics

ZoneAlarm Personal Firewall UDP Source Port 67 Bypass

medium Nessus Plugin ID 14660

Synopsis

This host is running a firewall that fails to filter certain types of traffic.

Description

This version of ZoneAlarm contains a flaw that may allow a remote attacker to bypass the ruleset. The issue is due to ZoneAlarm not monitoring and alerting UDP traffic with a source port of 67.

This allows an attacker to bypass the firewall to reach protected hosts without setting off warnings on the firewall.

Solution

Upgrade at least to version 2.1.25.

See Also

https://seclists.org/bugtraq/2000/Apr/134

Plugin Details

Severity: Medium

ID: 14660

File Name: zone_alarm_fw_p67.nasl

Version: 1.20

Type: local

Family: Firewalls

Published: 9/3/2004

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

Required KB Items: SMB/name, SMB/login, SMB/password, SMB/transport, zonealarm/version

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 4/20/2000

Reference Information

CVE: CVE-2000-0339

BID: 1137