Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
From: Peter Gründl (pgrundlkpmg.dk)
Date: Thu Jun 06 2002 - 07:17:16 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]


    Title: BlackICE Agent not Firewalling After Standby
    BUG-ID: 2002019
    Released: 06th Jun 2002

    In a default installation, The BlackICE Agent might not reactivate
    when the host returns from standby. This could allow a malicious
    user to bypass the firewall completely.

    - BlackICE Agent 3.1 eal on Windows 2000 laptop

    Not Vulnerable:
    - BlackICE Agent 3.1 ebh on Windows 2000 laptop

    The BlackICE Agent setup contains the parameter
    "restart.whenSuspend", which should be enabled by default. This,
    however, is not always the case, and as a result the firewall
    might not reactivate after a system standby. The BlackICE Agent
    would still give all the appearences of being active, but the
    filter function would not be in effect, and network communication
    would be possible to the same extent as if the software wasn't

    Vendor URL:
    You can visit the vendor webpage here: http://www.iss.net

    Vendor response:
    The vendor was notified on the 15th of March, 2002. The issue was
    assigned case number 526997. On the 18th of March, we received a
    workaround that seemingly solved the issue. On the 6th of June, 2002
    the vendor informed us that the issue had been corrected in the
    latest build.

    Corrective action:
    Upgrade to BlackICE Agent V3.1 EBH, available through:

    Author: Andreas Sandor (asandorkpmg.dk)
    KPMG is not responsible for the misuse of the information we provide
    through our security advisories. These advisories are a service to
    the professional security community. In no event shall KPMG be lia-
    ble for any consequences whatsoever arising out of or in connection
    with the use or spread of this information.