CVE-2005-3560
CVE-2005-3560 is a high-severity vulnerability in Zonelabs Zonealarm with a CVSS 2.0 base score of 7.5. Its EPSS exploit-prediction score of 14% places it in the 96th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: High (CVSS 2.0 base score 7.5)
- EPSS exploit prediction: 14% (96th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Zonelabs Zonealarm
- Published:
- Last modified:
Description
Zone Labs (1) ZoneAlarm Pro 6.0, (2) ZoneAlarm Internet Security Suite 6.0, (3) ZoneAlarm Anti-Virus 6.0, (4) ZoneAlarm Anti-Spyware 6.0 through 6.1, and (5) ZoneAlarm 6.0 allow remote attackers to bypass the "Advanced Program Control and OS Firewall filters" setting via URLs in "HTML Modal Dialogs" (window.location.href) contained within JavaScript tags.
Frequently asked questions
- What is CVE-2005-3560?
- Zone Labs (1) ZoneAlarm Pro 6.0, (2) ZoneAlarm Internet Security Suite 6.0, (3) ZoneAlarm Anti-Virus 6.0, (4) ZoneAlarm Anti-Spyware 6.0 through 6.1, and (5) ZoneAlarm 6.0 allow remote attackers to bypass the "Advanced Program Control and OS Firewall filters" setting via URLs in "HTML Modal Dialogs" (window.location.href) contained within JavaScript tags.
- How severe is CVE-2005-3560?
- CVE-2005-3560 has a CVSS 2.0 base score of 7.5, rated high severity.
- Is CVE-2005-3560 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 14% (96th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2005-3560?
- CVE-2005-3560 primarily affects Zonelabs Zonealarm. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2005-3560?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2005-3560 published?
- CVE-2005-3560 was published on 2005-11-16 and last updated on 2026-06-16.
References
- http://secunia.com/advisories/17450
- http://securityreason.com/securityalert/155
- http://www.osvdb.org/20677
- http://www.securityfocus.com/archive/1/415968
- http://www.securityfocus.com/bid/15347
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22971
Affected products (6)
- cpe:2.3:a:zonelabs:zonealarm:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:zonelabs:zonealarm:6.0:*:pro:*:*:*:*:*
- cpe:2.3:a:zonelabs:zonealarm_anti-spyware:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:zonelabs:zonealarm_anti-spyware:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:zonelabs:zonealarm_antivirus:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:zonelabs:zonealarm_security_suite:6.0:*:*:*:*:*:*:*
More vulnerabilities in Zonelabs Zonealarm
- CVE-2005-1693 — Critical (CVSS 10.0): Integer overflow in Computer Associates Vet Antivirus library, as used by CA InoculateIT 6.0, eTrust Antivirus r6.0…
- CVE-2004-0309 — Critical (CVSS 10.0): Stack-based buffer overflow in the SMTP service support in vsmon.exe in Zone Labs ZoneAlarm before 4.5.538.001,…
- CVE-2003-1309 — Critical (CVSS 10.0): The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before…
- CVE-2004-1936 — High (CVSS 7.5): ZoneAlarm Pro 4.5.538.001 and possibly other versions allows remote attackers to bypass e-mail protection via…
- CVE-2002-1997 — High (CVSS 7.5): ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email…
- CVE-2000-0339 — High (CVSS 7.5): ZoneAlarm 2.1.10 and earlier does not filter UDP packets with a source port of 67, which allows remote attackers to…