ZoneAlarm 2.1 through 2.6 and ZoneAlarm Pro 2.4 and 2.6 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2001-1525
http://www.securityfocus.com/bid/3647
http://www.iss.net/security_center/static/7671.php
http://archives.neohapsis.com/archives/bugtraq/2001-12/0065.html
http://archives.neohapsis.com/archives/bugtraq/2001-12/0056.html