CVE-2004-0612

View on CVE.org

Published Jun 30, 2004 CVSS 2.0 · 5.1 Medium EPSS 1.3% KEV · Not listed

Description

The Mobile Code filter in ZoneAlarm Pro 5.0.590.015 does not filter mobile code within an SSL encrypted session, which could allow remote attackers to bypass the mobile code filtering. NOTE: it has been disputed by the vendor that this behavior is required by the SSL specification.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:zonelabs:zonealarm:5.0.590.015:*:pro:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2004-0611	The Mobile Code filter in ZoneAlarm Pro 5.0.590.015 does not filter mobile code within an SSL encrypted session, which could allow remote attackers to bypass the mobile code filtering. NOTE: it has been disputed by the vendor that this behavior is required by the SSL specification.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploit prediction score: 1.3% (1.317% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
http://archives.neohapsis.com/archives/bugtraq/2004-06/0420.html
http://marc.info/?l=bugtraq&m=108786444608208&w=2
http://www.securityfocus.com/bid/10584
https://exchange.xforce.ibmcloud.com/vulnerabilities/16471

History

No history.

Subscriptions

Zonelabs Zonealarm

Weaknesses

NVD-CWE-Other

Sources

CVE record Updated: Aug 8, 2024, 12:24 AM

Status: PUBLISHED
Assigner: mitre
Published: Jun 30, 2004, 4:00 AM
Updated: Aug 8, 2024, 12:24 AM
Reserved: Jun 29, 2004, 12:00 AM

View source JSON

Vulnrichment No data

No data.

NVD Updated: Jun 16, 2026, 10:05 PM

Status: Modified
Published: Dec 6, 2004, 5:00 AM
Modified: Jun 16, 2026, 10:05 PM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2004-06-21T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The Mobile Code filter in ZoneAlarm Pro 5.0.590.015 does not filter mobile code within an SSL encrypted session, which could allow remote attackers to bypass the mobile code filtering. NOTE: it has been disputed by the vendor that this behavior is required by the SSL specification."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-10T14:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20040621 ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=108786444608208&w=2"}, {"name": "zonealarm-mobile-code-bypass(16471)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16471"}, {"name": "20040625 Zone Labs response to \"ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability\"", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0420.html"}, {"name": "10584", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/10584"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2004-0612", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Mobile Code filter in ZoneAlarm Pro 5.0.590.015 does not filter mobile code within an SSL encrypted session, which could allow remote attackers to bypass the mobile code filtering. NOTE: it has been disputed by the vendor that this behavior is required by the SSL specification."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20040621 ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=108786444608208&w=2"}, {"name": "zonealarm-mobile-code-bypass(16471)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16471"}, {"name": "20040625 Zone Labs response to \"ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability\"", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0420.html"}, {"name": "10584", "refsource": "BID", "url": "http://www.securityfocus.com/bid/10584"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T00:24:26.668Z"}, "title": "CVE Program Container", "references": [{"name": "20040621 ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=108786444608208&w=2"}, {"name": "zonealarm-mobile-code-bypass(16471)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16471"}, {"name": "20040625 Zone Labs response to \"ZoneAlarm Pro 'Mobile Code' Bypass Vulnerability\"", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0420.html"}, {"name": "10584", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/10584"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2004-0612", "datePublished": "2004-06-30T04:00:00.000Z", "dateReserved": "2004-06-29T00:00:00.000Z", "dateUpdated": "2024-08-08T00:24:26.668Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zonelabs:zonealarm:5.0.590.015:*:pro:*:*:*:*:*", "matchCriteriaId": "50E6E82F-5197-46D1-A0DE-F105177288C5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Mobile Code filter in ZoneAlarm Pro 5.0.590.015 does not filter mobile code within an SSL encrypted session, which could allow remote attackers to bypass the mobile code filtering. NOTE: it has been disputed by the vendor that this behavior is required by the SSL specification."}, {"lang": "es", "value": "El filtro de C\u00f3digo M\u00f3vil en ZoneAlarm PRO 5.0.590.015 no filtra c\u00f3digo m\u00f3vil dentro de una sesi\u00f3n SSL cifrada, lo que podr\u00eda permitir a un atacanter remoto saltarse el filtrado de c\u00f3digo m\u00f3vil. NOTA: El vendedor ha manifestado que esta conducta es requerida por la especificaci\u00f3n SLL."}], "id": "CVE-2004-0612", "lastModified": "2026-06-16T22:05:59.493", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2004-12-06T05:00:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0420.html"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=bugtraq&m=108786444608208&w=2"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/10584"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16471"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0420.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=108786444608208&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/10584"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16471"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}