Yesterday's monthly security updates for Microsoft users has caused problems with personal firewall software, at least for some PC set-ups. There has been widespread activity in tech forums relating to the free version of the popular ZoneAlarm program. But my own investigation suggests that there may be problems even with Windows Firewall itself - the firewall program that comes with Windows.
A firewall prevents unauthorised intrusions in a PC connected to the Internet. Corporations usually use hardware - essentially a computer that sits at the "gateway" to the Internet. Most home users use personal firewall software - programs that do the same thing.
ZoneAlarm say they are aware of the problem and investigating: http://forum.zonelabs.org/zonelabs/board/message?board.id=cfg&thread.id=52785
However, they are also recommending uninstalling the update in the meantime. This may be unwise for two reasons:
- KB951748 addresses an important security hole that may allow "DNS spoofing",
- Uninstalling KB951748 may prevent Windows Update working in the future - including any future fix from Microsoft to address the issues currently happening with personal firewalls.
A lengthy phone call with my Internet provider's technical support to check my connection showed it was ZoneAlarm. My own testing suggests the problem may also affect Windows Firewall itself. After restarting the PC later and not starting ZoneAlarm, I found I could not connect to the Internet again. I tried the following steps, which suggest Windows Firewall has been compromised:
1. Before restarting my PC (Windows XP Media Center 2005 Edition, SP3) I ran msconfig to select a selective start-up with "Load Startup Items" unchecked. I also ran a program called CCleaner to remove all temporary files from applications.
2. I hard reset my PC - Start | Turn Off Computer, and then powered off at the mains for a minute before re-starting.
3. I restarted the PC and checked that Windows Firewall was on from Start | Control Panel | Security Center. Although the Firewall was shown as on I could not browse with either Internet Explorer or Firefox. I then clicked the "Manage security settings for: Windows Firewall" link, which said it was off. I turned it on and still could not browse. This is significant because until this point ZoneAlarm was not starting up (as far as I can determine).
4. In order to browse, I had to start ZoneAlarm, and then shut it down - making sure that Windows Firewall was indeed working. I could then connect.
Finally, I checked that the Firewall was on at https://www.grc.com/x/ne.dll?bh0bkyd2
This confirmed that the tested ports were showing a "stealth" setting. (Something that switching ZoneAlarm's setting to "Medium" will not do, though appears to be one solution to getting online.)
Technical information on the KB951748 update is available here: http://www.microsoft.com/technet/security/bulletin/ms08-037.mspx












