Check Point Advisories

ZoneAlarm SMTP Buffer Overflow (CVE-2004-0309)

Vulnerability
Protection

Check Point Reference:	CPAI-2004-118
Date Published:	18 Mar 2010
Severity:	High
Last Updated:	Thursday 18 March, 2010
Source:
Industry Reference:	CVE-2004-0309
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Zone Alarm and Integrity Client products provide application-level SMTP session processing. A vulnerability exists in the SMTP protocol processing function in ZoneLabs' ZoneAlarm 4.x and Integrity client 4.x products. The vulnerability can be triggered by sending specific malformed links to the victim user and enticing the user to initiate an outgoing SMTP session with long strings in the SMTP commands. This leads to a successful exploitation allowing execution of arbitrary code with System privileges. Successful exploitation could make the current process and other kernel processes unstable. Moreover, it may lead to arbitrary code execution and local system privilege escalation.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the ZoneAlarm SMTP Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: SMTP Protection Violation.
Attack Information: ZoneAlarm SMTP buffer overflow