ZoneAlarm Problem With Microsoft Update

[Elton 172]

Windows updated today and I was left with no connection. After borrowing a mate's PC, I found this:

 

http://www.dslreports.com/forum/r20759839-...neAlarm-PROBLEM

 

Hope it saves some of you the sort of hassle I had!

[Leon Roskilly 25]

Windows updated today and I was left with no connection. After borrowing a mate's PC, I found this:

 

http://www.dslreports.com/forum/r20759839-...neAlarm-PROBLEM

 

Hope it saves some of you the sort of hassle I had!

 

Nope

 

Been stressing with Indians in Netgear Call Centre, and running up a phone bill to no avail, so restored to before the updates were applied and connecting fine now.

 

Useful to know, think I'll hold off on re-installing the update until problems sorted.

[Leon Roskilly 25]

Thought I'd install the update, uninstall zonealarm then download and reinstall zonealarm.

 

Fine until I attempted to download zonealam, then I get an error from the Zonealarm website and can't download:(

 

Just as well I've got this laptop!

 

Try again tomorrow I guess.

Edited July 9, 2008 by Leon Roskilly

[Newt 290]

Given that the hacker community now has details on the vulnerability and many are probably busy trying to write a critter to take advantage while the ZA issue leaves large numbers of unprotected PCs, I think I'd opt to install the update and set ZA to medium security (the default is high) which seems to remove the issue.

 

ZA will have to generate fix really soon and shame on them for not doing it already.

 

I suspect that some other firewall products have similar problems but are not as widely used so we haven't heard about them.

 

The firewall that comes as part of Windows OneCare will not have problems so folks running it can update without worry.

 

As it is now with an unpatched PC, it will be possible for you to click on a link to a known good site (such as this one) and be silently rerouted to a place you really do not want to be.

 

I'll try to stay on top of the update situation and if there are changes, to post about them here.

 

Details on the problems that MS08-037 / kb953230 is supposed to fix are at the link below. Some of the info is fairly technical but quite a bit is written in English and can give you a better idea of the situation.

 

http://support.microsoft.com/kb/953230

[Jeff S 0]

Zone Alarm is probably being inundated with requests for downloads and other things since it seems loads of people are looking for a 'fix'.

 

I wonder since you can't get to the web.... Are ports 80, and 443 open for web access? This makes sense in my mind.- A firewall by default leaves all ports outgoing open. BUT it closes inbound ports. Sooo.. TCP uses the same port the request went out on to return. By rights your software is working correctly but the FW (ZA) has closed the returning port.

 

I don't have ZA. Since it is freeware does it allow you to open and close ports?

 

Leon- AOL uses ports 5190 - 5193. MSN uses 6891-6901. They may require all to work correctly.

 

Well known port numbers

Edited July 9, 2008 by Jeff S

[Leon Roskilly 25]

I don't have ZA. Since it a freeware does it allow you to open and close ports?

 

 

Not as far as I'm aware (at least not the free version)

 

 

Newt, advice from Zonealarm is:

 

 

http://forums.zonelabs.com/zonelabs/board/...essage.id=52860

 

We have been working with MS over night on the issue. We are very confident a fix will be released soon. As far as how that is distributed either a patch from MS or in the form of a new build from ZA has not been determined.

 

We will notify all users of a fix when its ready at the top of the forum in the main announcements section.

 

We also still stand by our current workaround that you should uninstall the MS update KB951748

 

And do not set your ZA internet security level to Medium. By setting to Medium you potential expose your computers to a huge number of other threats than just the one that this patch from MS fixes.

[Dan 0]

Ive switched off ZA at startup and activated Windows firewall, is that ok?

 

Dan

 

 

PS Sheilds up says comp in stealth mode

Edited July 9, 2008 by Dan

[Newt 290]

Leon - I read that advice from ZA before I posted but all things considered, I can't agree with it. I probably should have noted in my post that they advised against 'medium'.

 

Folks who run ZA will simply have to make up their own minds about which option to pick since they seem to be mutually exclusive.

 

Since the whole issue is with a DNS security issue, the safest course for anyone not using a router would be to disable DNS and put all the links they plan to use for right now into a hosts file but anyone who could set that up almost certainly is not using ZA as their firewall.

 

Note to readers - if you disable DNS you will not be able to reach ANY link (effectively disabling your internet access) so I am not suggesting it.

[Steve Burke 177]

Well my fix was only temporary! Switched on the laptop this morning and back to square one and yesterday's fix doesn't work.

 

Think I'll put Windows Firewall on and uninstall ZA. However would like advice on order to do this. Presume should put on Windows Firewall first before taking off ZA as I don't want to be vulnerable.

 

Advice please Newt or other tech bod!

 

Peggy

[Jeff S 0]

Steve- You are correct. If you are behind a router you should be ok. Most routers you have to turn on the option to respond to a port sweep. If you aren't make sure you turn on windows firewall before turning off the other. You should never be without some sort of protection.