Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Security App Flaws :: hack0038.htm

Zone Labs response to "ZoneAlarm Pro 'Mobile Code' Bypass vuln"
Zone Labs response to "ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability"

Hash: SHA1

ZoneAlarm Pro, Security Suite and Integrity products which employ
Mobile Code Protection/ID Lock features do not inspect encrypted
traffic. If mobile code is downloaded via a Secure Sockets Layer
(SSL) session, it will not be inspected by these products. This is
by design and mandated by the SSL Protocol specification.

The intended purpose of SSL is to "provide privacy and reliability
between two communicating applications [1]." Computer users have
the expectation their SSL encrypted session will be encrypted
end-to-end between the server and client application (in this
case, the Web Browser).

As stated in the SSL Protocol Version 3.0:

   For SSL to be able to provide a secure connection, both the
   client and server systems, keys, and applications must be
   secure [1].

As such, Zone Labs products do not attempt to intercept, decrypt,
proxy, or otherwise interfere with the SSL transaction. For our
product -- or any other application -- to behave otherwise would
violate the intent and design of the SSL specification and could
potentially expose and/or risk the confidentiality of the data
transmitted in the SSL transaction.

A clarification of this feature's design will be made in the
product help files and program interface.

Zone Labs encourages anyone with concerns about the security of
our products or services to contact us at 


Version: PGP 8.0.2


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH