Software: Zone Labs Integrity 4.x
ZoneAlarm 4.x
ZoneAlarm Plus 4.x
ZoneAlarm Pro 4.x
Description:
eEye has discovered a vulnerability in ZoneAlarm and Integrity client, allowing malicious people to compromise a vulnerable system.
The vulnerability is caused due to a boundary error in the SMTP processing system. This can be exploited automatically without any user interaction if the SMTP service is active on a protected system.
Successful exploitation allows execution of arbitrary code with SYSTEM privileges.
The vulnerability has been reported to affect version 4.x. Prior versions are not vulnerable.
Solution: Update to the following versions:
* ZoneAlarm (Free, Plus, Pro) version 4.5.538.001
* Integrity client version 4.0.146.046
* Integrity client version 4.5.085
Provided and/or discovered by:
eEye Digital Security
Original Advisory:
http://download.zonelabs.com/bin/free/securityAlert/8.html
Please note: The information, which this Secunia Advisory is based upon, comes from third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
