CFP 3.0.11.246 RC1- Questions about how it works

[gibran]

@Eduardo post:93

I have a doubt respect with process termination. This function (process termination) is into Defense+ monitor settings… and, what whappens if I disable Defense+? Using Process Explorer v10.21, by Microsoft Sysinternals, I can suspend or kill cfp.exe and cmdagent.exe… This is really preocupant, while the stable version, 2.4, doesn’t need a HIPS function to protect it from process termination.

Firewall only V3 is only meant for PC with another HIPS.
V2 had some HIPS features, V3 has a full HIPS. If you care only about process termination you are wrong.
Anyway V2 still does a fine job so it still possible to use it until more advanced threats are widespread.

[system]

@gibran post:101

Firewall only V3 is only meant for PC with another HIPS.
V2 had some HIPS features, V3 has a full HIPS. If you care only about process termination you are wrong.
Anyway V2 still does a fine job so it still possible to use it until more advanced threats are widespread.

I’m not worried about anything, Eduardo was. (:LGH)

[foxman]

@Eduardo post:95

Now, Manage My Configurations.

“Manage My Configurations” has always been there and it “save” or “restore” the Firewall setting part, I am talking about the D+ part. Thanks anyway. Anybody else can help?

[mikeo1313]

I have to disable my Comodo firewall to share folders between my xp computers.

can anyone suggest a setting?

When network was detected, I did check make resources available to others…

Thanks

[gibran]

@mikeo1313 post:104

I have to disable my Comodo firewall to share folders between my xp computers.

can anyone suggest a setting?

When network was detected, I did check make resources available to others…

Thanks

You should create a trusted network zone using the stealth wizard. But V3 usually does this.
You can read this page if you want to configure it manually https://forums.comodo.com/cfp_beta_corner/cfp_308214_beta_workarounds_closed-t12091.0.html

[Citizen_K]

Been away a few weeks and installed the 246. I noticed the Global rules in the Network Security Policy have changed. It seems to have become less strict. What happened to the “old” rules? Where can I find them again?

[Coolio10]

Installer bug i think. Picking simple firewall automatically picks the new incoming alert mode. You have to pick advanced for it to use the default rules.

[hyatt69]

what happens when i put something in isolated application like ff or ie,is it like a virtual environment?

[Eduardo]

What really worry me is the fact that some of us (naive or negligence people) will use HIPS active, so the firewall will be easily killed… Correct if I’m wrong…

[adric]

@hyatt69 post:108

what happens when i put something in isolated application like ff or ie,is it like a virtual environment?

No, isolated application basically means block everything it does. Isolating your browser would render it useless for the internet.

Al

[gibran]

@Eduardo post:109

What really worry me is the fact that some of us (naive or negligence people) will use HIPS active, so the firewall will be easily killed… Correct if I’m wrong…

When HIPS is active there is no porcess termination.
If you meant the opposite I guess that a warning in the installer would be enough.

[Searinox]

Matousec reports the following existing vulnerability in CFP 2.4 latest version.

http://www.matousec.com/info/advisories/Comodo-Bypassing-settings-protection-using-magic-pipe.php

Has it been fixed/dealt with in version 3?

[system]

Hi.

https://forums.comodo.com/leak_testingattacksvulnerability_research/cfp_easily_bypassed_20070801-t11187.0.html

[salohcin]

Is there any way to disable this? I don’t want to review any files…

[Searinox]

@Soyabeaner post:113

Hi.

https://forums.comodo.com/leak_testingattacksvulnerability_research/cfp_easily_bypassed_20070801-t11187.0.html

Thanks for the reply. So as fat as I’m reading it’ll be fixed in 2.5 but no one’s sure if it’ll be fixed in 3 right…?

[mikeo1313]

@gibran post:105

You should create a trusted network zone using the stealth wizard. But V3 usually does this.
You can read this page if you want to configure it manually https://forums.comodo.com/cfp_beta_corner/cfp_308214_beta_workarounds_closed-t12091.0.html

After going through stealth ports wizard {on comps}, trusting all lan comp ips, still blocking svhost icmp’s & not allowing access to shared folders. What next?

[Ragwing]

@Searinox post:115

Thanks for the reply. So as fat as I’m reading it’ll be fixed in 2.5 but no one’s sure if it’ll be fixed in 3 right…?

I think you misunderstood it.

@Ragwing post:2

And also, I think it won’t be fixed as CPF3 is on the way, but maybe they’ll fix all 2.4 bug and all vulnerabilites, and make a v 2.5 for non XP/Vista-users.

Note that I said maybe
As for now, no update to version 2.x is announced.

Cheers,
Ragwing

[xantor]

I have the same problem as mikeo1313, we use windows xp file sharing, with CFP 2.4 it works like a charm but since i installed V3 RC1 in my computer i cant get access to the windows network not even if i disable the firewall, i have to deinstall CFP3 RC1 to be able to browse the network again, my PDC is a linux server with samba, i tried the steps enumerated in the post on how to set one of the earlier betas to be able to work with samba but still cant get it to work.

Anyone can help me here?

[kail]

Hi xantor, welcome to the forums.

xantor/mikeo1313: I didn’t use CFPs automatic rule generation this time & I created my own rules. I got my LAN working by the following… I created a Zone, I called it LAN imaginatively enough. This Zone is defined to encompass the whole subnet on which the LAN operates (also allowing for broadcasts). So, an IP range of x.x.x.0 to x.x.x.255 (this obviously could be restricted further if needed, ie. for a wireless LAN).

I then created 2 Network Security Policy - Global Rules - Allow All (IP All) Outbound where Target is LAN & Allow All (IP All) Inbound where Sender is LAN. In my configuration I placed these rules high up, positions 2 & 3. I my case, positions 1 & 2 are taken up by a blocking Zone (doing the opposite, completely blocking IP networks). Other than that I added the 2 same Allow In & Out entries to both Service & svchost.exe in the Application Rules. I did the same for some other applications, including the Print Spooler that I wanted to have unfettered LAN access. And the LAN works just fine with this.

[Opus_Dei]

It will pass v3 if you do not always allow when prompted

@Searinox post:115

Thanks for the reply. So as fat as I’m reading it’ll be fixed in 2.5 but no one’s sure if it’ll be fixed in 3 right…?

In the thread below Soya mentions Melih says they will be fixed in V3

@Soyabeaner post:113

Hi.

https://forums.comodo.com/leak_testingattacksvulnerability_research/cfp_easily_bypassed_20070801-t11187.0.html

And in the post below I tested an early version of v3 it passed
matousec said in their methodology for this test when given the option “Allow” or “Deny” they always select "Allow.
If a users always "Allow"s at any prompt by a fire wall I think there is little possibility of passing a leak test.

This is not standard methodology even for matousec

@Opus Dei post:7

I don´t think the Matousec moustec ran those specific tests in their tests, they do not classify them a leak tests they call them “testing programs”. These are listed as vlnerabilites below. And I ran them with 2.4.18.184 and they failed. It also seems I remember reading in the comodo forums that these were not being passed by CPF 2.4.18.184. The good news is they seem to passing now (CFPA 3.0.2.5)in my tests

Matousec Advisory 2007-03-01.01
Comodo Bypassing settings protection using magic pipe Vulnerability
Vulnerable software: Comodo Firewall Pro 2.4.18.184

Matousec Advisory 2007-02-15.01
Comodo DLL injection via weak hash function exploitation Vulnerability
Vulnerable software: Comodo Firewall Pro 2.4.17.183 (2-4-18.184 was released on February 16,2007)

OD

PS
Edit:Note on methodology: I read on the Matousec site that in the methodology used for one of the above mentioned tests was to always click “Allow” whenever given the option to "Allow " or “Deny”. In my methodolgy I click “Allow” only to start the program with a parent of Command. (if run from the Command Prompt) or Explorer.exe if the program is launched from the Windows GUI. Also if the program is supposed to display a screenshot in paint or another graphics program I will “Allow” access to this program at the end of the test to see itf the screen shot is displayed. at all other prompts I click Deny as if I don´t what the program is that is asking for access. This is my normal procedure if something fails to function properly I will save what is need and reboot if that is what is required.

Hope this helps
OD