The Channel logo

News

By | John Leyden 9th July 2008 10:05

MS DNS patch snuffs net connection for ZoneAlarm users

A cure worse than the disease

Updated Microsoft released four patches - all rated important - as part of its regular Patch Tuesday update cycle, one of which left ZoneAlarm users locked out the internet.

The most significant of the quartet fixes a flaw in Windows' implementations of the Domain Name System protocol (MS08-037.mspx). Multiple vendors are subject to the DNS-spoofing vulnerability, which stems from a fundamental weakness involving a lack of entropy in DNS queries rather than a specific security bug. Successfully exploiting the flaw could allow hackers to spoof DNS replies, creating a means to redirect network traffic or to mount man-in-the-middle attacks.

Unfortunately Microsoft's fix creates problems in itself, leaving users of the popular ZoneAlarm firewall unable to access the internet after they apply the patch.

The experiences of Reg reader Steve seem typical. "I woke up this morning to no internet at all and on calling my ISP's tech support I was told there was an issue with the latest patches and Zone Alarm," he reports. "I have uninstalled Zone Alarm and everything now works fine. Not sure who is to blame on this one but it has been a pain."

ZoneAlarm has published a list of recommended workarounds to dealing for the glitch here.

Microsoft's three other patches cover vulnerabilities in Exchange server and SQL Server and, on the desktop, bugs in Windows Explorer. The Explorer vuln potentially creates a means for hackers to inject malware onto vulnerable systems running Windows Vista. This flaw - along with cross-site scripting vulnerabilities in Outlook for Web Access that affect MS Exchange and information disclosure bugs in SQL Server - are all rated "important" by Redmond but "critical" by security watchers at the SANS Institute's Internet Storm centre.

Redmond's summary can be found here. ISC's easier to understand "Black Tuesday" overview is here. ®

comment icon Read 59 comments on this article alert Send corrections

Opinion

Microsoft CEO Satya Nadella
ARA_LIbertad

Chris Mellor

Elliott Management sinks its teeth into retiring godhead
Satya Nadella
cloud computing Fight

Features

Failure to crack next-gen semiconductors threatens to set back humanity
SMEs get lip service - what they need is dinner at the Club
SAP Match Insights
Vorsprung durch grossendatatechnik, as we like to say in Germany
Inside the Google Lab where surgeons prepare the human/dog experiment
Big Blue exec tells El Reg what to keep an eye on