OSVDB ID: 20677

Title: ZoneAlarm ShowHTMLDialog() Outbound Filter Bypass

Info

Disclosure
Nov 08, 2005

Discovery
Oct 10, 2005

Dates

Exploit
Unknown

Solution
Unknown

Description

 Various ZoneAlarm products contain a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a trusted web browser is used to execute the ShowHTMLDialog() function. Malware can then create a modal dialog box to display HTML, and redirect the victim to the attacker's web site.

Classification

 Location: Local Access Required
Attack Type: Information Disclosure
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Rumored / Private
Disclosure: OSVDB Verified

Solution

 Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

Zone Labs, Inc.

ZoneAlarm

 Pro 6.0
Internet Security Suite 6.0
Anti-Virus 6.0
Anti-Spyware 6.1
Anti-Spyware 6.0

References

Credit
  • Debasis Mohanty - debasisBrand New Doo Doohackingspirits.com -


Direct URL: http://osvdb.org/36218