CVE-2019-8453 : Security Advisory and Response

Check Point ZoneAlarm versions up to 15.4.062 may load certain DLLs from directories with write permissions, allowing a local attacker to perform a DLL substitution attack, leading to Denial of Service.

Understanding CVE-2019-8453

Check Point ZoneAlarm vulnerability impacting versions up to 15.4.062.

What is CVE-2019-8453?

Check Point ZoneAlarm up to version 15.4.062 loads DLLs from directories with broad write permissions.
Local attackers can exploit this to replace DLL files with malicious ones, causing a Denial of Service.

The Impact of CVE-2019-8453

Local attackers can substitute DLL files, leading to Denial of Service for the client.

Technical Details of CVE-2019-8453

Vulnerability details and affected systems.

Vulnerability Description

DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are sourced from directories with universal write permissions.

Affected Systems and Versions

Product: Check Point ZoneAlarm
Vendor: Not applicable
Versions affected: up to 15.4.062

Exploitation Mechanism

Local attackers can replace DLL files with harmful ones due to improper directory permissions.

Mitigation and Prevention

Protective measures and actions to mitigate the vulnerability.

Immediate Steps to Take

Update Check Point ZoneAlarm to version 15.4.062 or later.
Restrict write permissions on directories containing DLLs.
Monitor DLL file integrity for unauthorized changes.

Long-Term Security Practices

Implement the principle of least privilege for directory permissions.
Conduct regular security audits to identify vulnerabilities.

Patching and Updates

Apply patches and updates provided by Check Point for ZoneAlarm to address the vulnerability.