Zone Labs response to "ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability"

["Zone Labs Product Security" <Product-Security () zonelabs com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ZoneAlarm Pro, Security Suite and Integrity products which employ 
Mobile Code Protection/ID Lock features do not inspect encrypted 
traffic. If mobile code is downloaded via a Secure Sockets Layer 
(SSL) session, it will not be inspected by these products. This is 
by design and mandated by the SSL Protocol specification. 

The intended purpose of SSL is to "provide privacy and reliability 
between two communicating applications [1]." Computer users have the
expectation their SSL encrypted session will be encrypted end-to-end
between the server and client application (in this case, the Web
Browser). 

As stated in the SSL Protocol Version 3.0: 

   For SSL to be able to provide a secure connection, both the client
   and server systems, keys, and applications must be secure [1]. 

As such, Zone Labs products do not attempt to intercept, decrypt,
proxy, 
or otherwise interfere with the SSL transaction. For our product --
or 
any other application -- to behave otherwise would violate the intent
and 
design of the SSL specification and could potentially expose and/or 
risk the confidentiality of the data transmitted in the SSL
transaction. 

A clarification of this common program limitation will be made 
in the product help files and program interface. 

Zone Labs encourages anyone with concerns about the security of our
products or services to contact us at security () zonelabs com.


[1] http://wp.netscape.com/eng/ssl3/draft302.txt 

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQA/AwUBQNjWClDxXw2Is3mLEQJXvACg7qHHdJQ3O36pSypxv+BEnj8K1vEAoKc7
WrvhXTtn75BZ3mu6XRzAWOqY
=fXFJ
-----END PGP SIGNATURE-----