MS DNS patch snuffs net connection for ZoneAlarm users
A cure worse than the disease
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Updated Microsoft released four patches - all rated important - as part of its regular Patch Tuesday update cycle, one of which left ZoneAlarm users locked out the internet.
The most significant of the quartet fixes a flaw in Windows' implementations of the Domain Name System protocol (MS08-037.mspx). Multiple vendors are subject to the DNS-spoofing vulnerability, which stems from a fundamental weakness involving a lack of entropy in DNS queries rather than a specific security bug. Successfully exploiting the flaw could allow hackers to spoof DNS replies, creating a means to redirect network traffic or to mount man-in-the-middle attacks.
Unfortunately Microsoft's fix creates problems in itself, leaving users of the popular ZoneAlarm firewall unable to access the internet after they apply the patch.
The experiences of Reg reader Steve seem typical. "I woke up this morning to no internet at all and on calling my ISP's tech support I was told there was an issue with the latest patches and Zone Alarm," he reports. "I have uninstalled Zone Alarm and everything now works fine. Not sure who is to blame on this one but it has been a pain."
ZoneAlarm has published a list of recommended workarounds to dealing for the glitch here.
Microsoft's three other patches cover vulnerabilities in Exchange server and SQL Server and, on the desktop, bugs in Windows Explorer. The Explorer vuln potentially creates a means for hackers to inject malware onto vulnerable systems running Windows Vista. This flaw - along with cross-site scripting vulnerabilities in Outlook for Web Access that affect MS Exchange and information disclosure bugs in SQL Server - are all rated "important" by Redmond but "critical" by security watchers at the SANS Institute's Internet Storm centre.
Redmond's summary can be found here. ISC's easier to understand "Black Tuesday" overview is here. ®
COMMENTS
Partial resolution
Ladies and Gents
Here in the SE USA I too was bitten by the bug.
Symptoms:
Desktop PC through wireless router to DOCSIS modem allowed me full access to email but very short (2 to 3 mins only) access to the WWW.
This PC had Zone Alarm Free edition installed.
Wireless Laptop had no issues at all but did not have Zone Alarm installed nor do I think that updates have been allowed for a couple of weeks.
I de-installed Zone Alarm and still had the same problem,
I de-installed KB951748 and all is back to normal.
I am going to sit back for a spell and wait until the collective suppliers of (Patches/software et al:) fix the issue at which time I will re-install Zone Alarm. I have been very happy with ZA for a couple of years now so indeed want it back on my system and soon.
Thanks all for the heads up.
Incidently, could not find any instance of KB951748 having been installed when I opened Control panel Add/Remove even though "Show Updates" was checked. I had to do a search for the patch then manually de-install it.
G. Earl// Atlanta Georgia USA
Patch d/l'd
Patch zapSetup_70_483_000_en.exe downloaded and all's well in the Zone Alarm world!
KB951748
Hit my Windows machines too. Good thing I also run a Linux desktop. I could establish what the problem was and fix it fast. But if I had not had net access via Linux, it could have taken ages.
Something to do with eggs and baskets.......
Bob H
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
