ZoneAlarm 2.1 through 2.6 and ZoneAlarm Pro 2.4 and 2.6 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters.
http://www.iss.net/security_center/static/7671.php
http://archives.neohapsis.com/archives/bugtraq/2001-12/0065.html