RE: Different Claims by ZoneLabs on the "Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue

["Debasis Mohanty" <mail () hackingspirits com>]

> > Paul Laudanski
> > What I'm saying is that the vendor never claimed ZAP versions prior to 5
are not vulnerable in the report.  

Funny Paul!! You are simple exaggerating upon the same point again and again
in a new style each time. Well, They don't even say that ZAP versions prior
to v5 are vulnerable in their advisory. 

Can you say Product X Pro is un-affected to a particular vulnerability while
Product X (ver 4x / 5x ..) are vulnerable.. NO ! The statement is not
specific and will keep the customers/users clueless whether or not their
firewall version is weak.. The vendor needs to be specific here saying which
versions of Product X Pro is un-affected and which are not.

You many also like to read the ZA user's comments on this issue posted at
Zone Labs's user forum - 
http://forums.zonelabs.com/zonelabs/board/message?board.id=security&message.
id=13104#M13104


Its really funny to see that the vendor wants to keep their EGO up-2-date by
covering up this issue with their latest version 6.0 =))



Gud Luck !! 

-D





-----Original Message-----
From: Paul Laudanski [mailto:zx () castlecops com] 
Sent: Monday, October 03, 2005 9:06 PM
To: Debasis Mohanty
Cc: 'Zone Labs Security Team'; bugtraq () securityfocus com;
full-disclosure () lists grok org uk
Subject: RE: [Full-disclosure] Different Claims by ZoneLabs on the
"Bypassing PersonalFirewall (Zone Alarm Pro) Using DDE-IPC" issue

On Mon, 3 Oct 2005, Debasis Mohanty wrote:

> Paul,
>
> > > This does not include the version 3.7.159 you are testing.  
>
> Didn't get the meaning by what you mean by "This does not include". Do 
> u mean whether or not version 3.7.159 is vulnerable it shouldn't be 
> conscidered??

What I'm saying is that the vendor never claimed ZAP versions prior to 5 are
not vulnerable in the report.  So you're comment is redundant.  Simply
upgrade your version.  Ciao.

--
Paul Laudanski, Microsoft MVP Windows-Security CastleCops(SM),
http://castlecops.com



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/