CFP 3.0.11.246 RC1- Questions about how it works

Searinox · November 13, 2007, 7:12pm

Thanks for the reply. So as fat as I’m reading it’ll be fixed in 2.5 but no one’s sure if it’ll be fixed in 3 right…?

mikeo1313 · November 13, 2007, 7:22pm

After going through stealth ports wizard {on comps}, trusting all lan comp ips, still blocking svhost icmp’s & not allowing access to shared folders. What next?

Ragwing · November 13, 2007, 7:27pm

I think you misunderstood it.

Note that I said maybe
As for now, no update to version 2.x is announced.

Cheers,
Ragwing

xantor · November 13, 2007, 8:53pm

I have the same problem as mikeo1313, we use windows xp file sharing, with CFP 2.4 it works like a charm but since i installed V3 RC1 in my computer i cant get access to the windows network not even if i disable the firewall, i have to deinstall CFP3 RC1 to be able to browse the network again, my PDC is a linux server with samba, i tried the steps enumerated in the post on how to set one of the earlier betas to be able to work with samba but still cant get it to work.

Anyone can help me here?

kail · November 13, 2007, 9:31pm

Hi xantor, welcome to the forums.

xantor/mikeo1313: I didn’t use CFPs automatic rule generation this time & I created my own rules. I got my LAN working by the following… I created a Zone, I called it LAN imaginatively enough. This Zone is defined to encompass the whole subnet on which the LAN operates (also allowing for broadcasts). So, an IP range of x.x.x.0 to x.x.x.255 (this obviously could be restricted further if needed, ie. for a wireless LAN).

I then created 2 Network Security Policy - Global Rules - Allow All (IP All) Outbound where Target is LAN & Allow All (IP All) Inbound where Sender is LAN. In my configuration I placed these rules high up, positions 2 & 3. I my case, positions 1 & 2 are taken up by a blocking Zone (doing the opposite, completely blocking IP networks). Other than that I added the 2 same Allow In & Out entries to both Service & svchost.exe in the Application Rules. I did the same for some other applications, including the Print Spooler that I wanted to have unfettered LAN access. And the LAN works just fine with this.

Opus_Dei · November 13, 2007, 10:38pm

It will pass v3 if you do not always allow when prompted

In the thread below Soya mentions Melih says they will be fixed in V3

And in the post below I tested an early version of v3 it passed
matousec said in their methodology for this test when given the option “Allow” or “Deny” they always select "Allow.
If a users always "Allow"s at any prompt by a fire wall I think there is little possibility of passing a leak test.

This is not standard methodology even for matousec

Opus Dei post:7:

I don´t think the Matousec moustec ran those specific tests in their tests, they do not classify them a leak tests they call them “testing programs”. These are listed as vlnerabilites below. And I ran them with 2.4.18.184 and they failed. It also seems I remember reading in the comodo forums that these were not being passed by CPF 2.4.18.184. The good news is they seem to passing now (CFPA 3.0.2.5)in my tests

Matousec Advisory 2007-03-01.01
Comodo Bypassing settings protection using magic pipe Vulnerability
Vulnerable software: Comodo Firewall Pro 2.4.18.184

Matousec Advisory 2007-02-15.01
Comodo DLL injection via weak hash function exploitation Vulnerability
Vulnerable software: Comodo Firewall Pro 2.4.17.183 (2-4-18.184 was released on February 16,2007)

OD

PS
Edit:Note on methodology: I read on the Matousec site that in the methodology used for one of the above mentioned tests was to always click “Allow” whenever given the option to "Allow " or “Deny”. In my methodolgy I click “Allow” only to start the program with a parent of Command. (if run from the Command Prompt) or Explorer.exe if the program is launched from the Windows GUI. Also if the program is supposed to display a screenshot in paint or another graphics program I will “Allow” access to this program at the end of the test to see itf the screen shot is displayed. at all other prompts I click Deny as if I don´t what the program is that is asking for access. This is my normal procedure if something fails to function properly I will save what is need and reboot if that is what is required.

Hope this helps
OD

Opus_Dei · November 14, 2007, 4:49am

These are some questions I put as part of bug report Has anyone played with the wild cards (?) & (*) yet??
for more details see the topic link below

Thanks
OD

Opus Dei post:92:

I imput this as “code” the BB code was changing my every 3 “?” marks to ???


3),4) & 5) really belong in "CFP 3.0.11.246 RC1- Questions about how it works"
3)  After bug 2 is fixed 
  would it be possible to add users using wild cards either ? or *
  for example 
  C:\Documents and Settings\*\Menú Inicio\Programas\Inicio\*
  or this
  C:\Documents and Settings\??????????????\Menú Inicio\Programas\Inicio\*

4)  Clarification
  What is the difference in the wild cards(*) & (?) 
  my guess is that 
   4A)  (*) Represents a complete file name or directory tree and must be used 
      at the end 
      i.e  %windir%\system32\GroupPolicy\User\Scripts\Logon\*
   4B)  (?) represents an individual character and there must exist a ? wildcard
      for each charcter 
      i.e in %windir%\system32\GroupPolicy\User\Scripts\Logon\* user would need 
      to be represented using 4 wildcards ????) like this
      %windir%\system32\GroupPolicy\????\Scripts\Logon\*

5)  More claification 
  Can the wild cards be combined as in 4B)
  %windir%\system32\GroupPolicy\????\Scripts\Logon\*

Thanks in advance
OD

gibran · November 14, 2007, 8:35am

I think C:\Documents and Settings*\Menú Inicio\Programas\Inicio* should already work.
I’ve not tested more than one ? as I usually use * for this. It should work, hey, maybe it could be used to workaround the multiple progra~? issue
but I cannot test this as I no longer have this issue.

Searinox · November 14, 2007, 8:58am

That’s what I meant, Iwasn’t referring to Ragwing’s post but to the one where Melih says they’ll be fixed.

chesterns · November 14, 2007, 3:45pm

Hello,

I am unable to put my WAMP server online on my Vista machine when Comodo Firewall 3 RC1 is running. If I close comodo, it runs okay. I’m in Safe Mode - Learning, and don’t get any prompts to allow/deny, and I have manually added the application file and services to the trusted applications list and still no love.

intel core 2 duo, vista 32 bit, nod32 antivirus, latest version of WAMP.

Thanks,
Ben

Searinox · November 14, 2007, 6:02pm

http://www.matousec.com/projects/windows-personal-firewall-analysis/Comodo-Personal-Firewall-2.3.6.81/

Click on “show bugs”. There’s lots of criticals, can someone tell me how many of those are fixed in v3?

Melih · November 15, 2007, 4:20am

there shouldn’t be a critical bug left in v3

Melih

Searinox · November 15, 2007, 11:24am

Wow… coming like that from the admin it sounds pretty reassuring. I didn’t know so much attention had been payed to securing the design of the firewall. I guess there’s more changes under the hood than just a new interface and extra features eh? Neat.

adric · November 15, 2007, 12:37pm

Can anyone explain when and what determines if new files are added to the ‘My Pending Files’ list?

I have seen files such as *.dll, *.sys and *.exe and I assume there are more, but I have
not noticed others so far. Files considered safe by CFP do not get added which is what I expect.

I have seen files with and without digital signatures added to the list. I do not understand why files with valid digital signatures are placed there. New *.msi files do not get added even though they are unknown to Comodo. There are other extensions too that are not added. How does ‘My Trusted Software Vendors’ fit into the picture?

Can we expect any documentation on this kind of stuff or is it up to us to figure it out? >:(

It would have been nice if Comodo had released a document for the BETA testers about how CFP is supposed to function etc. I for one would find it easier to test with a bit of documentation. Another benefit of this would be a lot less forum clutter from those of us that RTFM.

Al

gibran · November 15, 2007, 1:11pm

adric post:128:

Can anyone explain when and what determines if new files are added to the ‘My Pending Files’ list?

I have seen files such as *.dll, *.sys and *.exe and I assume there are more, but I have
not noticed others so far. Files considered safe by CFP do not get added which is what I expect.

I have seen files with and without digital signatures added to the list. I do not understand why files with valid digital signatures are placed there. New *.msi files do not get added even though they are unknown to Comodo. There are other extensions too that are not added. How does ‘My Trusted Software Vendors’ fit into the picture?

Can we expect any documentation on this kind of stuff or is it up to us to figure it out? >:(

It would have been nice if Comodo had released a document for the BETA testers about how CFP is supposed to function etc. I for one would find it easier to test with a bit of documentation. Another benefit of this would be a lot less forum clutter from those of us that RTFM.

Al

It’s only a about time and a help file will come. I guess that the last RC should have that.

From what I’ve tested and read in the beta section My pending list should be able to report changes to protected file extension so it should monitor the executables list in My Protected Files.
My pending list is a place to have an overall view of files/folders changes (this is important too as there is no hash checking) plus it has the ability to disable autolearning for files in the list.
This way you can override autolearning as long as there is no rule for an executable.
So if you wish to disable autolearning for few files you can add those to My pending list.

I guess that one useful addition could be enabling groups in My pending list in order to separate the files you add from the ones added by V3.

kail · November 16, 2007, 12:55am

It’s better than that Searinox, Melih isn’t really just an Admin… he’s the CEO of Comodo.

Opus_Dei · November 16, 2007, 1:51am

Not only that he seems to be a pretty nice guy with a good business model (R)

but I bet Melih can be a bear as release dates approach
Egemen would know better than the rest of us.

Again don’t let it go to your head Melih

OD

Trel · November 16, 2007, 5:58am

2 quick questions

Is there any option to have “Remember this answer” unchecked by default on all alerts?
Is there any way to clear unremembered blocks or allows without rebooting?

Ragwing · November 16, 2007, 3:54pm

Don’t think there is, it’ll go after what you selected on the last alert. If you uncheck “Remember this answer” on alert 1, it’ll be unchecked on alert 2, same if you choose “Remember this answer”.

I didn’t quite understand, but I think you meant how to generate a new alert for an application that you’ve (temporary) denied/allowed to something and want to change the permission?
If that’s the case, restarting the program will give you a new alert. For example, if you’ve blocked explorer.exe to run mspaint.exe, you’ll need to restart explorer.exe before you’ll get a new alert for mspaint.exe.

Cheers,
Ragwing

system · November 16, 2007, 9:55pm

Is there anymore skins or do we have to create our own?