MS Security Patch Blocks Net Access For ZoneAlarm Users 110
An anonymous reader writes "Users of Check Point ZoneAlarm security products, including the extremely popular, free-of-charge software firewall, have discovered that a Microsoft security update released on Tuesday has blocked their internet access. The firewall manufacturer is 'investigating the issue,' and so far the workaround seems to be to uninstall the recent DNS spoofing vulnerability fix MS08-037 (KB951748), and not reinstall it until Microsoft or Check Point have come up with updated versions of their products."
And this is a bad thing how? (Score:5, Funny)
Re:And this is a bad thing how? (Score:5, Funny)
"MS Security Patch perfects ZoneAlarm firewall"
Re:And this is a bad thing how? (Score:5, Interesting)
I know you wrote it as a joke, but it gets me thinking on the proprietary software problem again (yeah yeah, I know, more anti-MS babbling). The risk of having your operating system suddenly lose internet access completely is inadmissible. Since Windows is a closed-source product, only the maker (Microsoft) knows how to fix vulnerabilities. And if they screw up, like in this case, we have to depend on them to fix the problem. Either you lose internet access, or still are vulnerable to the DNS exploit.
Re:And this is a bad thing how? (Score:5, Informative)
You make the immediate assumption that it was a problem with the MS Patch. I'll wait until the final news release about the subject, in case it's an issue with Zone Alarm. Why is Zone Alarm the only firewall with this problem (so far)? Is Zone Alarm firewall released as open source? Free != Open Source. Your same argument against MS can just as easily be applied to Check Point.
Layne
But.. (Score:2, Funny)
But this is Slashdot.. ofcource it is Microsoft's fault.
Re: (Score:2, Insightful)
It's not a hard question and, thus, not a surprising answer when Microsoft is blamed.
AND you are absolutely correct about Check Point NOT being open source themselves; if they were it might also present a path to the resolution.
Otherwise, my bet is that:
Re: (Score:3, Insightful)
I think his main argument is just against proprietary (ie, non-open source) software, meaning that regardless of who's to blame here, this is an example of why FOSS is better.
Re: (Score:2)
I think his main argument is just against proprietary (ie, non-open source) software, meaning that regardless of who's to blame here, this is an example of why FOSS is better.
Exactly! That's what I wanted to say.
(whew, that was close!)
Re: (Score:2, Insightful)
Re: (Score:2)
The difference is that if the original developer on an open source project quits, you could hire someone to take the code and continue working on it. That might not sound feasible to an individual, but it might sound very good to a corporation.
Re: (Score:1)
You make the immediate assumption that it was a problem with the MS Patch.
In my book, it was a problem with the MS Patch. MS of all companies should know that they aren't releasing software into a vacuum, that they have to play nice with existing software. They should have noticed this update's incompatibility with ZoneAlarm before releasing it. They deserve a stinging slap on the wrist for not mentioning ZA in their knowledge base article about the update, and for not even mentioning DNS in the Automatic Update dialog. If it weren't for the article about the coordinated DNS
Re: (Score:2, Insightful)
Re: (Score:1)
Re: (Score:1)
You're right.
s/works\ just\ fine/functions\ the\ same\ as\ it did\ before\ the\ patch/
Re: (Score:2)
You Linux people and your cryptic commands.....
^Hworks just fine[TAB]functions the same as it did before the patch[ALT-A]
Much fewer keystrokes.
Layne
Re: (Score:3, Funny)
They should have gotten a warrant?
Re: (Score:3)
Are you trying to somehow credit open source software with bringing together disparate development teams on total different projects to test & QA their software releases together? That's insane.
Be realistic, whatever system-wide stability advantage Linux (the OS) has is because of the centralized distribution model now commonly used, and can be credited solely to the maintainers of said distribution. Even the centralization hasn't been all that great until recent years, and you still have to use cauti
One program breaks and it's an M$ issue? Nah. (Score:5, Insightful)
...or instead of complaining to Microsoft, you can disable ZoneAlarm and enjoy having your connection work again. Cheap firewalls failing to perform exactly how you'd like them to is an old, old story.
Given the ridiculous profusion of budget 'security' software swarming around, it hardly seems fair to lay the blame on M$ when ZoneAlarm is the only program that this patch appears to conflict with.
Of course, if ZoneAlarm wasn't proprietary, we could go see where they screwed up. Maybe you should go harass them for being closed-source instead?
Re: (Score:3, Interesting)
...or instead of complaining to Microsoft, you can disable ZoneAlarm and enjoy having your connection work again.
Touché. I'd mod you up. Anyway, now that you mention it... the point of zonealarm is that the default firewall that comes with Windows is terribly insecure. It's interesting how a proprietary OS ends up spawning a lot of proprietary firewall and antivirus software.
My point? No point, it's just interesting to see how proprietary spawns proprietary... as if they were living beings.
Re: (Score:2)
you are clearly forgetting that disassembled code is still code. you could just as easily find out what zonealarm screwed up, it just takes more time. what's the difference between open-source and closed-source? comments and clearly defined coding structures.
i wrote a 3d engine when i was 12. i wrote cryptic comments, had a bunch of variables named d0 d1 d2 etc, and had function names like TheHackFunction. my friend saw my engine and wanted to use it for his game, so i gave it to him in the spirit of o
A lot more than Microsoft (Score:5, Informative)
We have a Cisco ASA at work for a large enterprise and about 2 hours after I applied the patch to our DNS servers running BIND, they the ASA device blackholed the DNS servers. Wasn't a fun day really.
Re: (Score:2)
Or at least keeps their bot infested piece of junk from spamming the rest of us. :-)
other workaround (Score:5, Informative)
Set Zonealarm's security level to "medium".
Another workaround (Score:3, Interesting)
Re: (Score:3, Interesting)
I've tried multiple firewalls over the years, including that one, and had a variety of issues ranging from general system stability problems to constant BSOD's. So much so I don't even bother anymore. I'm behind a router. I know it's not perfect, but having one less buggy, unstable program in the background makes life a lot nicer.
Off the top of my head I tried ZoneAlarm, both old and new versions, Tiny Personal Firewall, the prior TPF that had a different name, and several others.
Just not worth the aggravat
Re: (Score:1)
Now that's a descriptive product name!
Comodo: flush those bad packets away!
*If you don't get why this is funny, see :)
http://www.merriam-webster.com/dictionary/commode [merriam-webster.com]
definitions 2c and 2d
Re: (Score:2)
Set Zonealarm's security level to "medium".
For those of you using the GUI, that's the checkbox next to the goatse icon.
Re: (Score:2, Insightful)
Don't you think it's hard to take a security product seriously when its settings are "high", "medium", and "low"?
Not that other products are any better...
Re: (Score:3, Informative)
That would be horrifically stupid -- don't EVER enable incoming TCP ports like those unless you know what you're doing. Outbound ports are you connecting out, but inbound ports allow anyone on the internet to try and connect to you on those ports, none of which relate to DNS lookups -- that would be port 53 (UDP and/or rarely TCP).
Re: (Score:2)
Untrue and irrelevant. NAT or no NAT, don't open inbound ports to service ports like this, EVER unless you're running a server that needs it.
If you're a normal user, you'd open (for example) an outbound port 53 UDP and TCP for DNS queries, and inbound replies (source port 53, NOT destination port). Preferably, your firewall software would have been made in the last 5 years and simply allow inbound replies automatically (otherwise you're just wide open).
Re: (Score:2)
I never specified inbound or outbound, but since UDP is stateless, specifically allowing inbound packets may be required, depending on the router. Ditto for NTP (different protocol, same problem, port 123 though).
I was simply making the point that none of the ports the parent to my original comment specified had anything to do with DNS.
Thanks for the "update" (Score:2)
Crap! Here come the phone calls asking for tech support...I think I'll turn off my phone for a bit...
Re: (Score:2)
Re: (Score:1)
Crap! Here come the phone calls asking for tech support...I think I'll turn off my phone for a bit...
Kind of like a firewall for your telephone, eh?
Girlfriends Comp (Score:1)
Re: (Score:1)
After you found out it was ZoneAlarm, you should have pretended it was something else and changed that, too.
What? Somebody's gotta keep your girlfriend in line, and I sure ain't got time!
Re: (Score:1)
BTW-for those unsure if you're broken (Score:4, Funny)
Now please don't call me asking if it's something you should worry about.
Re:BTW-for those unsure if you're broken (Score:5, Funny)
Re: (Score:1)
How do you normally log onto the internet ? Did you check you don't have capslock on that happened to me once. It might just be
A friend of mine said he had the same problem and upgraded to Office 2008, I think he said, and that fixed it.
Belthize
Re: (Score:1)
Re: (Score:1)
It could be:
#127 - Sticky bits on the disk.
or
#237 - Plate voltage too low on demodulator tube.
Re: (Score:2)
#237 - Plate voltage too low on demodulator tube.
Now you've done it!
Poor confused users will now be calling their senators, ISPs and their great-uncles that were TV repair techs in the '60s.
Cheers!
Strat
Re: (Score:2)
Re: (Score:2)
Okay, I'll just ask by email.
Security through obscurity (Score:1)
Good idea MS!!
In all Fairness to Microsoft (Score:5, Informative)
This patch was not designed to patch a Microsoft flaw, but instead a vulnerability in nearly all implementations of DNS. So far over 100 vendors have patched their products and coordinated the release of this workaround. If zone alarm is broken because of this change they need to adjust their product to work with this change, not the other way around.
I've taken this snippet from: http://isc.sans.org/diary.html?storyid=4687 [sans.org] which explains things in a little more detail. Full details won't be disclosed until Blackhat in vegas this August.
The root cause is a fundamental, well known, weakness in the DNS protocol. DNS uses UDP, a stateless protocol. A DNS server will send a request in a single UDP packet, then wait for a response to come back. In order to match request and response, a number of parameters are checked:
who sent the response? Was it the DNS server we sent the request to?
for this particular response, do we have an outstanding request?
each request uses a unique and random query ID. The response has to use the same query ID.
The response has to be sent to the same port from which the request was sent.
Only if all this matches, the response is accepted. The first valid response wins. If an attacker is able to guess the query id and the source port, the attacker is able to send a fake response, which will be cached by the DNS server.
Re: (Score:2)
Wow thank you (Score:1)
Re: (Score:1)
In all Fairness to Microsoft
How could you?
Re: (Score:2)
If an attacker is able to guess the query id and the source port, the attacker is able to send a fake response, which will be cached by the DNS server.
It'd also work if the attacker was able to sniff that packet in the first place, of course, and with a much higher probability.
DNS over TCP for queries as well as zone transfers has long been an option for most DNS servers. Enabling that as the default would seem to be a secure enough fix, although with more overhead than UDP.
I haven't taken the time to see what this new recommended fix does. Anyone have details on how it makes the query response harder to fake?
Re:In all Fairness to Microsoft (Score:5, Informative)
I haven't taken the time to see what this new recommended fix does. Anyone have details on how it makes the query response harder to fake?
Sure. The security update [microsoft.com] addresses the vulnerabilities by using strongly random DNS transaction IDs, using random sockets for UDP queries, and updating the logic used to manage the DNS cache.
Re: (Score:1)
Cheers for the explanation! I've just got online after closing Zone Alarm down.
I think one problem is going to be the fact Zone Alarm can't check for updates when it has started, so it's going to be a bit difficult to auto roll a fix out?
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Thanks! I was just reviewing the Microsoft patch at work today - evaluating what category it should go into ("OMG NOW NOW NOW", "Soon", "Next Release", "Never.")
That helps a lot with understanding it. (I said "Next Release", by the way.)
Not just Zone Alarm (Score:2)
From articles I've read on the subject, a LOT of the personal firewalls for Windows PCs are having this problem.
Why are we blaming Microsoft? (Score:4, Insightful)
Re:Why are we blaming Microsoft? (Score:4, Insightful)
Re: (Score:2)
Similar here: plenty of people will purposefully make stupid anti-MS statements, irrelevant of if they believe it or not or even care whose fault it is, in the hopes that if done sufficiently, it'll sink into the public mindset.
Careful now, with such logic and level-headedness like that you could end up in twitter's journal [slashdot.org] and everything :)
Re: (Score:2)
Re: (Score:2)
I can assure you that's not good enough. No, your hatred of "M$" does not seem sincere enough. Might also want to check the other list [slashdot.org], just to make sure you're not in it. Like those pesky "vista defenders" and people like me, with special mysterious powers to ruin accounts =)
Re: (Score:2)
Re: (Score:2)
"I'm guessing that the firewall software whitelists outgoing UDP requests from port 53, and the new randomized ports are being blocked, preventing DNS queries from succeeding."
Then you're guessing wrong; DNS works fine, but http gets blocked.
I agree though, that it could be a flaw in Zonealarm rather than Windows, since it hooks into the OS at such a low level.
Alternative solution (Score:1)
Get rid of ZoneAlarm and use a decent firewall!
Re: (Score:2)
Amen. I've got to say, I've seen many many boxes keel over with ZoneAlarm installed; it does nasty things with kernel hooks and so forth that doesn't bear thinking about. There are some decent software firewalls out there, but ZoneAlarm isn't one of them.
Re: (Score:1)
Re: (Score:1)
The real issue is . . . . (Score:2, Insightful)
Microsoft should have tested this security update with all the popular firewall software and notified the developers of the firewall software itself. Then Microsoft and the affected software companies should have sent a notification of this issue to registered users of their software.
Zone Alarm certainly counts as popular firewall software
If Microsoft did not test this against zone alarm , than that is pretty shabby QA on the part of Microsoft. If they did, and did not find the issue than it is still pret
Re: (Score:1)
Software FW..sigh, hold bridge of nose, shake head (Score:5, Informative)
Ahh the great security blanket called the software firewall. I like to use the following analogy in regards to them. Having a software firewall on your computer is like having a security guard in your bathroom. If something gets to the guard it's too late, your network is already compromised.
I work for an ISP in Tacoma WA, and Software firewalls cause many more problems then they solve. I don't care which company makes it.
If you are really concerned about security then you will have a dedicated hardware firewall. These are inexpensive and common, even built into most SOHO routers.
So I know there will probably be flames, but if you write software firewalls, remember that the overwhelming majority of people who use them don't usually know they have one, and just ignore those little messages and click allow on everything until they actually read something and say "msimn.exe, what's that? I'm gonna block it!" And then they call me because their e-mail doesn't work.
Re: (Score:2)
The software firewall is the last line of defense. It's supposed to work with your hardware firewall, not as a replacement to it.
Re:Software FW..sigh, hold bridge of nose, shake h (Score:4, Insightful)
The may be a big headache for somebody at an ISP who needs to help out users, but as somebody who uses ZoneAlarm, I find it to be very useful.
I've got an actual firewall in my router, but that only protects me from what comes in. And I run Linux, so that counters most other random garbage. But, on occasion, I use Windows and ZoneAlarm is very handy because it alerts me when any program is trying to send data out.
*This* is where software firewalls in Windows shine. So many programs in Windows phone home or access the Internet for completely unknown reasons. So, I block it. If it breaks and I really need that particular program, I can unblock it. It's hard to measure how much this really helps, and, of course, I'm sure there are ways to transmit in Windows without the firewall knowing about it. Still, it's nice to be able to say apps X and Y, you get to access the Net. Everybody else has to ask first.
Re:Software FW..sigh, hold bridge of nose, shake h (Score:1)
Well I've almost never had issues with ZA over quite a few years. I'd rather have the malicious probes wasting my fast, underused network bandwith than have the hassle of setting up and maintaining yet another piece of equipment. (Especially anything to do with networks!)
Also, wouldn't it be a bit much to have 3 devices (cable modem, firewall, router) to run a network that has only 2 computers attached? Or even worse to landfill a perfectly adequate router to get one with a firewall that I clearly don't act
Re:Software FW..sigh, hold bridge of nose, shake (Score:3, Informative)
It's bad if an *outbound* software firewall is your ONLY form of defence. But it is an INBOUND firewall too and it does a damn good job of that, considering. I've had people back in the dial-up / USB broadband modem days who used it exclusively as a defence and there were no problems at all. They frequently got attack probes aimed at them and they all bounced off harmlessly. For five minutes work and a free download, it's much better value for money than trying to put a hardware firewall into computer n
Re: (Score:1)
So... what does that make my router's firewall? It's exactly the same as the one on my PC, and I'm pretty sure that's software.
Re: (Score:2)
No it is definitely NOT the same as the one on your PC unless of course you happen to be running OpenBSD and ipf on your PC.
The main difference is that your router is a device solely designed for networking. There are no other hooks into the OS that can easily breach your security as exist on your computer, which is designed to perform many functions other than networking. The firewall on your router was designed to work specifically with the exact hardware in that box.
The firewall on your router also exist
We'll Get You to Vista One Way or Another (Score:2, Funny)
Microsoft starts new ad campaign about how great Vista is now and XP suddenly fails. Good one, Balmer.
Ok, a little help here (Score:2)
Re: (Score:3, Informative)
Par For the Course (Score:4, Insightful)
And what do Slashdot readers have to say? In about equal numbers:
OK geniuses. What, realistically, is the industry supposed to do in order to stop doing this sort of thing?
I don't know what the answer is. If I did, I'd be lining up staffing, capital, etc. But I'm 100% sure that it is not:
Re: (Score:1)
I was wondering what happened yesterday (Score:2)
Did an update, and all of the sudden, no internet. Removed the update and the internet was back.
Didn't realize it had anything to do with Zonealarm.
ZoneAlarm have fixed this (Score:1, Informative)
ZoneAlarm have released an update to fix this. Check out there technical support page http://www.zonealarm.com/store/content/support/techSupport.jsp
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)