Forgot your password?
typodupeerror
Bug Networking Operating Systems Security Software Windows IT

MS Security Patch Blocks Net Access For ZoneAlarm Users 110

Posted by timothy
from the oh-there-can't-be-more-than-a-handful dept.
An anonymous reader writes "Users of Check Point ZoneAlarm security products, including the extremely popular, free-of-charge software firewall, have discovered that a Microsoft security update released on Tuesday has blocked their internet access. The firewall manufacturer is 'investigating the issue,' and so far the workaround seems to be to uninstall the recent DNS spoofing vulnerability fix MS08-037 (KB951748), and not reinstall it until Microsoft or Check Point have come up with updated versions of their products."
This discussion has been archived. No new comments can be posted.

MS Security Patch Blocks Net Access For ZoneAlarm Users

Comments Filter:
  • by trolltalk.com (1108067) on Wednesday July 09, 2008 @04:14PM (#24123419) Homepage Journal

    a Microsoft security update released on Tuesday has blocked their internet access.

    ... it certainly makes their computers less prone to being hacked on the net ...

    • by Floritard (1058660) on Wednesday July 09, 2008 @04:19PM (#24123505)
      So the headline should have read:

      "MS Security Patch perfects ZoneAlarm firewall"
    • ... it certainly makes their computers less prone to being hacked on the net ...

      I know you wrote it as a joke, but it gets me thinking on the proprietary software problem again (yeah yeah, I know, more anti-MS babbling). The risk of having your operating system suddenly lose internet access completely is inadmissible. Since Windows is a closed-source product, only the maker (Microsoft) knows how to fix vulnerabilities. And if they screw up, like in this case, we have to depend on them to fix the problem. Either you lose internet access, or still are vulnerable to the DNS exploit.

      • by SQLGuru (980662) on Wednesday July 09, 2008 @04:40PM (#24123901) Journal

        You make the immediate assumption that it was a problem with the MS Patch. I'll wait until the final news release about the subject, in case it's an issue with Zone Alarm. Why is Zone Alarm the only firewall with this problem (so far)? Is Zone Alarm firewall released as open source? Free != Open Source. Your same argument against MS can just as easily be applied to Check Point.

        Layne

        • But.. (Score:2, Funny)

          by Anonymous Coward

          But this is Slashdot.. ofcource it is Microsoft's fault.

        • Re: (Score:2, Insightful)

          by Anonymous Coward
          What changed?

          It's not a hard question and, thus, not a surprising answer when Microsoft is blamed.

          AND you are absolutely correct about Check Point NOT being open source themselves; if they were it might also present a path to the resolution.

          Otherwise, my bet is that:
          1. Zone-Alarm expects a portion of MS's network stack to behave in a certain way and it has now changed,
          2. Microsoft broke changed something in their API, or as I suspect
          3. Zone-Alarm mis-interpreted the API or poorly coded to it.
        • Re: (Score:3, Insightful)

          by snoyberg (787126)

          I think his main argument is just against proprietary (ie, non-open source) software, meaning that regardless of who's to blame here, this is an example of why FOSS is better.

          • I think his main argument is just against proprietary (ie, non-open source) software, meaning that regardless of who's to blame here, this is an example of why FOSS is better.

            Exactly! That's what I wanted to say.

            (whew, that was close!)

          • Re: (Score:2, Insightful)

            Agreed, but only when the corporation who owns the source is incompetent. So to blanket all proprietary software, IMHO, is rather unfair. Either way, unless you're spending your own time developing the software, you're trusting somebody; if not a single corporation, then the Open Source Community. The point is, it's really just up to you, the user, to decide who you trust more.
            • by snoyberg (787126)

              The difference is that if the original developer on an open source project quits, you could hire someone to take the code and continue working on it. That might not sound feasible to an individual, but it might sound very good to a corporation.

        • You make the immediate assumption that it was a problem with the MS Patch.

          In my book, it was a problem with the MS Patch. MS of all companies should know that they aren't releasing software into a vacuum, that they have to play nice with existing software. They should have noticed this update's incompatibility with ZoneAlarm before releasing it. They deserve a stinging slap on the wrist for not mentioning ZA in their knowledge base article about the update, and for not even mentioning DNS in the Automatic Update dialog. If it weren't for the article about the coordinated DNS

          • Re: (Score:2, Insightful)

            by jeebusroxors (812064)
            So MS has to test their updates with EVERY piece of software that _may_ be used? It seems more likely that this is a ZA problem. Plus I'm willing to bet that the Windows firewall alone (that's still included right?) works just fine.
            • Whoa, whoa, whoa...has ANYONE ever claimed that the built-in Windows firewall "works just fine"?
              • You're right.

                s/works\ just\ fine/functions\ the\ same\ as\ it did\ before\ the\ patch/

                • by SQLGuru (980662)

                  You Linux people and your cryptic commands.....

                  ^Hworks just fine[TAB]functions the same as it did before the patch[ALT-A]

                  Much fewer keystrokes.

                  Layne

      • Re: (Score:3, Funny)

        by quonsar (61695)
        The risk of having your operating system suddenly lose internet access completely is inadmissible.

        They should have gotten a warrant?
      • Are you trying to somehow credit open source software with bringing together disparate development teams on total different projects to test & QA their software releases together? That's insane.

        Be realistic, whatever system-wide stability advantage Linux (the OS) has is because of the centralized distribution model now commonly used, and can be credited solely to the maintainers of said distribution. Even the centralization hasn't been all that great until recent years, and you still have to use cauti

      • by Behrooz (302401) on Wednesday July 09, 2008 @07:49PM (#24127207)

        ...or instead of complaining to Microsoft, you can disable ZoneAlarm and enjoy having your connection work again. Cheap firewalls failing to perform exactly how you'd like them to is an old, old story.

        Given the ridiculous profusion of budget 'security' software swarming around, it hardly seems fair to lay the blame on M$ when ZoneAlarm is the only program that this patch appears to conflict with.

        Of course, if ZoneAlarm wasn't proprietary, we could go see where they screwed up. Maybe you should go harass them for being closed-source instead?

        • Re: (Score:3, Interesting)

          by Spy der Mann (805235)

          ...or instead of complaining to Microsoft, you can disable ZoneAlarm and enjoy having your connection work again.

          Touché. I'd mod you up. Anyway, now that you mention it... the point of zonealarm is that the default firewall that comes with Windows is terribly insecure. It's interesting how a proprietary OS ends up spawning a lot of proprietary firewall and antivirus software.

          My point? No point, it's just interesting to see how proprietary spawns proprietary... as if they were living beings.

        • by dknj (441802)

          you are clearly forgetting that disassembled code is still code. you could just as easily find out what zonealarm screwed up, it just takes more time. what's the difference between open-source and closed-source? comments and clearly defined coding structures.

          i wrote a 3d engine when i was 12. i wrote cryptic comments, had a bunch of variables named d0 d1 d2 etc, and had function names like TheHackFunction. my friend saw my engine and wanted to use it for his game, so i gave it to him in the spirit of o

    • by suso (153703) * on Wednesday July 09, 2008 @05:54PM (#24125535) Homepage Journal

      We have a Cisco ASA at work for a large enterprise and about 2 hours after I applied the patch to our DNS servers running BIND, they the ASA device blackholed the DNS servers. Wasn't a fun day really.

    • by sjames (1099)

      Or at least keeps their bot infested piece of junk from spamming the rest of us. :-)

  • other workaround (Score:5, Informative)

    by TheSHAD0W (258774) on Wednesday July 09, 2008 @04:15PM (#24123435) Homepage

    Set Zonealarm's security level to "medium".

    • Another workaround (Score:3, Interesting)

      by martinw89 (1229324)
      Why not take this time to try out something new [comodo.com]?
      • Re: (Score:3, Interesting)

        I've tried multiple firewalls over the years, including that one, and had a variety of issues ranging from general system stability problems to constant BSOD's. So much so I don't even bother anymore. I'm behind a router. I know it's not perfect, but having one less buggy, unstable program in the background makes life a lot nicer.

        Off the top of my head I tried ZoneAlarm, both old and new versions, Tiny Personal Firewall, the prior TPF that had a different name, and several others.

        Just not worth the aggravat

      • by ChrisLynx (102341)

        Now that's a descriptive product name!

        Comodo: flush those bad packets away!

        *If you don't get why this is funny, see
        http://www.merriam-webster.com/dictionary/commode [merriam-webster.com]
        definitions 2c and 2d :)

    • by goombah99 (560566)

      Set Zonealarm's security level to "medium".

      For those of you using the GUI, that's the checkbox next to the goatse icon.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Don't you think it's hard to take a security product seriously when its settings are "high", "medium", and "low"?

      Not that other products are any better...

  • Crap! Here come the phone calls asking for tech support...I think I'll turn off my phone for a bit...

    • by Bomarc (306716)
      ... and this /. story explains my brothers phone call late last night.
    • Crap! Here come the phone calls asking for tech support...I think I'll turn off my phone for a bit...

      Kind of like a firewall for your telephone, eh?

  • So that what was causing the issue. I spend almost an hour trying to figure out what went wrong. Funny thing is she suggested it was ZA. Uninstalled and got net back online. I demand a refund for my wasted hour!
    • by pxc (938367)

      After you found out it was ZoneAlarm, you should have pretended it was something else and changed that, too.

      What? Somebody's gotta keep your girlfriend in line, and I sure ain't got time!

    • You wasted 4 minutes of my life and I want them back. /moleman
  • by faloi (738831) on Wednesday July 09, 2008 @04:18PM (#24123497)
    If you're reading this article from a machine in question, you're not broken.

    Now please don't call me asking if it's something you should worry about.
    • by gEvil (beta) (945888) on Wednesday July 09, 2008 @04:28PM (#24123655)
      I'm pretty sure the computer I'm on right now is affected by this problem. Tell me what I need to do to fix it. It's a G5 iMac running Microsoft Tiger. The problem started when I updated Internet Safari. Please help!!!
      • by belthize (990217)

            How do you normally log onto the internet ? Did you check you don't have capslock on that happened to me once. It might just be

            A friend of mine said he had the same problem and upgraded to Office 2008, I think he said, and that fixed it.

        Belthize

      • by pklinken (773410)
        Argh, Technologyhypochondriacs!
      • It could be:
        #127 - Sticky bits on the disk.

        or

        #237 - Plate voltage too low on demodulator tube.

        • by BlueStrat (756137)

          #237 - Plate voltage too low on demodulator tube.

          Now you've done it!

          Poor confused users will now be calling their senators, ISPs and their great-uncles that were TV repair techs in the '60s.

          Cheers!

          Strat

    • by Fnord666 (889225)
      Is this something I should worry about?
    • Now please don't call me asking if it's something you should worry about.

      Okay, I'll just ask by email.

  • Obscure the computer from the internet and its secure!

    Good idea MS!!
  • by docstrange (161931) on Wednesday July 09, 2008 @04:33PM (#24123747) Homepage

    This patch was not designed to patch a Microsoft flaw, but instead a vulnerability in nearly all implementations of DNS. So far over 100 vendors have patched their products and coordinated the release of this workaround. If zone alarm is broken because of this change they need to adjust their product to work with this change, not the other way around.

    I've taken this snippet from: http://isc.sans.org/diary.html?storyid=4687 [sans.org] which explains things in a little more detail. Full details won't be disclosed until Blackhat in vegas this August.

    The root cause is a fundamental, well known, weakness in the DNS protocol. DNS uses UDP, a stateless protocol. A DNS server will send a request in a single UDP packet, then wait for a response to come back. In order to match request and response, a number of parameters are checked:

    who sent the response? Was it the DNS server we sent the request to?
    for this particular response, do we have an outstanding request?
    each request uses a unique and random query ID. The response has to use the same query ID.
    The response has to be sent to the same port from which the request was sent.
    Only if all this matches, the response is accepted. The first valid response wins. If an attacker is able to guess the query id and the source port, the attacker is able to send a fake response, which will be cached by the DNS server.

    • Well at least *someone* remembers the stories that were posted just a few days ago...
    • Dude that was such a cool breakdown of the situation. I love it when people do that - someone did that the other day with the post about the gpcode virus and how it does it encryption etc and it was an eye opener.
    • In all Fairness to Microsoft

      How could you?

    • If an attacker is able to guess the query id and the source port, the attacker is able to send a fake response, which will be cached by the DNS server.

      It'd also work if the attacker was able to sniff that packet in the first place, of course, and with a much higher probability.

      DNS over TCP for queries as well as zone transfers has long been an option for most DNS servers. Enabling that as the default would seem to be a secure enough fix, although with more overhead than UDP.

      I haven't taken the time to see what this new recommended fix does. Anyone have details on how it makes the query response harder to fake?

    • by Mushdot (943219)

      Cheers for the explanation! I've just got online after closing Zone Alarm down.

      I think one problem is going to be the fact Zone Alarm can't check for updates when it has started, so it's going to be a bit difficult to auto roll a fix out?

    • by J_Doh! (830090)
      Short term work around. Set the internet security zone to medium. Make sure your behind a hardware firewall though. Just tried it, and it worked.
    • Haven't we known about this vulnerability for years ?
    • by Ritchie70 (860516)

      Thanks! I was just reviewing the Microsoft patch at work today - evaluating what category it should go into ("OMG NOW NOW NOW", "Soon", "Next Release", "Never.")

      That helps a lot with understanding it. (I said "Next Release", by the way.)

  • From articles I've read on the subject, a LOT of the personal firewalls for Windows PCs are having this problem.

  • by Alereon (660683) on Wednesday July 09, 2008 @05:19PM (#24124785)
    Why are we assuming that this is a defect in the Microsoft patch, rather than a defect in the security software? I think it's much more likely that the software firewall application (which tend to be pretty skeevy in general, see Norton Internet Security) is inappropriately blocking access than that Microsoft screwed up the patch. From my (admittedly vague) understanding of the issue, I'm guessing that the firewall software whitelists outgoing UDP requests from port 53, and the new randomized ports are being blocked, preventing DNS queries from succeeding. I know blaming Microsoft is fun, but blaming even crappier software vendors is more fun :)
    • by Paradigm_Complex (968558) on Wednesday July 09, 2008 @06:18PM (#24126007)
      Why are you assuming that we're assuming? Vista got a lot more heat than it really deserved, often by people who know better. However, much of the public at large believed the complaints. Most non-technies I know, when the subject comes up, cite something along the lines of "I heard Vista sucks." No explanation why (often because they don't think they'd understand, they just don't care). Similar here: plenty of people will purposefully make stupid anti-MS statements, irrelevant of if they believe it or not or even care whose fault it is, in the hopes that if done sufficiently, it'll sink into the public mindset. Maybe they feel justified in giving MS back what it deserves after all the bad stuff they've gotten away with. Now mod me -1 Insightful so Joe Sixpack doesn't see this and we can continue our conspi^H^H^H^H^H^H vigilante fight for software freedom!
      • Similar here: plenty of people will purposefully make stupid anti-MS statements, irrelevant of if they believe it or not or even care whose fault it is, in the hopes that if done sufficiently, it'll sink into the public mindset.

        Careful now, with such logic and level-headedness like that you could end up in twitter's journal [slashdot.org] and everything :)

        • I think I'm safe from twitter's journal [slashdot.org], but yeah every once in a while I accidentally say something logical. I'll try not to let it happen again, but no promises. P.S. if we end up being twitter-journal-buddies I call top bunk.
          • by dedazo (737510)

            I can assure you that's not good enough. No, your hatred of "M$" does not seem sincere enough. Might also want to check the other list [slashdot.org], just to make sure you're not in it. Like those pesky "vista defenders" and people like me, with special mysterious powers to ruin accounts =)

            • Oh-oh. Just make sure to save a comfy spot for me on the list, 'cuz I look like I'd fit right in if I keep accidentally making sense.
    • by 0123456 (636235)

      "I'm guessing that the firewall software whitelists outgoing UDP requests from port 53, and the new randomized ports are being blocked, preventing DNS queries from succeeding."

      Then you're guessing wrong; DNS works fine, but http gets blocked.

      I agree though, that it could be a flaw in Zonealarm rather than Windows, since it hooks into the OS at such a low level.

  • Get rid of ZoneAlarm and use a decent firewall!

    • Amen. I've got to say, I've seen many many boxes keel over with ZoneAlarm installed; it does nasty things with kernel hooks and so forth that doesn't bear thinking about. There are some decent software firewalls out there, but ZoneAlarm isn't one of them.

    • by webcite1 (817099)
      So, Windows fire wall is your cake? Eat it or die! BS!
  • by Anonymous Coward

    Microsoft should have tested this security update with all the popular firewall software and notified the developers of the firewall software itself. Then Microsoft and the affected software companies should have sent a notification of this issue to registered users of their software.

    Zone Alarm certainly counts as popular firewall software

    If Microsoft did not test this against zone alarm , than that is pretty shabby QA on the part of Microsoft. If they did, and did not find the issue than it is still pret

    • by dino2gnt (1072530)
      Explain to me why Microsoft should be supporting for ZoneAlarm at all, regardless of its popularity? it's not Microsoft's responsibility to make sure CheckPoint's software runs on their systems - it's CheckPoint's.
  • by GlL (618007) <gil.net-venture@com> on Wednesday July 09, 2008 @06:35PM (#24126289)

    Ahh the great security blanket called the software firewall. I like to use the following analogy in regards to them. Having a software firewall on your computer is like having a security guard in your bathroom. If something gets to the guard it's too late, your network is already compromised.

    I work for an ISP in Tacoma WA, and Software firewalls cause many more problems then they solve. I don't care which company makes it.

    If you are really concerned about security then you will have a dedicated hardware firewall. These are inexpensive and common, even built into most SOHO routers.

    So I know there will probably be flames, but if you write software firewalls, remember that the overwhelming majority of people who use them don't usually know they have one, and just ignore those little messages and click allow on everything until they actually read something and say "msimn.exe, what's that? I'm gonna block it!" And then they call me because their e-mail doesn't work.

    • by Joe U (443617)

      The software firewall is the last line of defense. It's supposed to work with your hardware firewall, not as a replacement to it.

    • The may be a big headache for somebody at an ISP who needs to help out users, but as somebody who uses ZoneAlarm, I find it to be very useful.

      I've got an actual firewall in my router, but that only protects me from what comes in. And I run Linux, so that counters most other random garbage. But, on occasion, I use Windows and ZoneAlarm is very handy because it alerts me when any program is trying to send data out.

      *This* is where software firewalls in Windows shine. So many programs in Windows phone home or access the Internet for completely unknown reasons. So, I block it. If it breaks and I really need that particular program, I can unblock it. It's hard to measure how much this really helps, and, of course, I'm sure there are ways to transmit in Windows without the firewall knowing about it. Still, it's nice to be able to say apps X and Y, you get to access the Net. Everybody else has to ask first.

    • Well I've almost never had issues with ZA over quite a few years. I'd rather have the malicious probes wasting my fast, underused network bandwith than have the hassle of setting up and maintaining yet another piece of equipment. (Especially anything to do with networks!)

      Also, wouldn't it be a bit much to have 3 devices (cable modem, firewall, router) to run a network that has only 2 computers attached? Or even worse to landfill a perfectly adequate router to get one with a firewall that I clearly don't act

    • It's bad if an *outbound* software firewall is your ONLY form of defence. But it is an INBOUND firewall too and it does a damn good job of that, considering. I've had people back in the dial-up / USB broadband modem days who used it exclusively as a defence and there were no problems at all. They frequently got attack probes aimed at them and they all bounced off harmlessly. For five minutes work and a free download, it's much better value for money than trying to put a hardware firewall into computer n

    • by Ant P. (974313)

      So... what does that make my router's firewall? It's exactly the same as the one on my PC, and I'm pretty sure that's software.

      • by GlL (618007)

        No it is definitely NOT the same as the one on your PC unless of course you happen to be running OpenBSD and ipf on your PC.
        The main difference is that your router is a device solely designed for networking. There are no other hooks into the OS that can easily breach your security as exist on your computer, which is designed to perform many functions other than networking. The firewall on your router was designed to work specifically with the exact hardware in that box.
        The firewall on your router also exist

  • Microsoft starts new ad campaign about how great Vista is now and XP suddenly fails. Good one, Balmer.

  • I'm fairly sure that I've just installed this patch. BUT, I haven't rebooted yet. (I'm using ZA, obviously). How can I stop the process of the patch being applied before I reboot so I don't fritz my computer? Thanks
    • Re: (Score:3, Informative)

      by punissuer (1036512)
      Don't worry. Removing the patch was easy once I knew that was what needed to be done. Just go to Add/Remove Programs, check the box for "Show updates", scroll down to KB951748, click the Remove button, and reboot (again).
  • Par For the Course (Score:4, Insightful)

    by vtcodger (957785) on Wednesday July 09, 2008 @09:30PM (#24128143)
    OK. Microsoft has once again put a bunch of users off the air -- tying up the clever and the lucky for a few minutes, and probably crippling many users for days. Not the first time. Won't be the last.

    And what do Slashdot readers have to say? In about equal numbers:

    1. Blame Microsoft
    2. Blame the "Application"
    3. That old favorite -- Blame the user.

    OK geniuses. What, realistically, is the industry supposed to do in order to stop doing this sort of thing?

    I don't know what the answer is. If I did, I'd be lining up staffing, capital, etc. But I'm 100% sure that it is not:

    1. Install Ubuntu
    2. Don't worry, be happy
    3. Blame the User
  • Did an update, and all of the sudden, no internet. Removed the update and the internet was back.

    Didn't realize it had anything to do with Zonealarm.

  • by Anonymous Coward

    ZoneAlarm have released an update to fix this. Check out there technical support page http://www.zonealarm.com/store/content/support/techSupport.jsp

Never trust a computer you can't repair yourself.

Working...