Vulnerabilities in firewalls are nothing new. Especially when it is outbound traffic. Black ice for example is notorious for this. It gives a false sense of security in it's interface and alarms, but often times does not really evaluate the outbound traffic well enough to prevent trojans from floating through. Go figure. Improperly patched and hardened software firewalls will always be vulnerable in some fashion. Mutually, someone running *nix based firewalls who haven't properly hardened them will be vulnerable as well.
Regards.
\"I believe that you can reach the point where there is no longer any difference between developing the habit of pretending to believe and developing the habit of believing.\"
Commercial firewalls are the most dangerous ones, for example the linux based Gnatbox and Robox.
Run a search on Astalavista and sure something (some script the kiddies can use) will turn up.
Patching and remaining up to date is essential.