Info

Last Modified

6 months ago

Percent Complete

100%

Disclosure

Apr 29, 2005

Discovery

Feb 25, 2005

Dates

Exploit

Unknown

Solution

Unknown

Description

Kerio MailServer, Personal Firewall, and WinRoute Firewall contain a flaw that may lead to an unauthorized password exposure. It is possible to gain access to plain text passwords when an attacker knows at least one valid password and can connect to the remote administration port. Passwords that are shorter than 6 characters can be easily brute forced, which may lead to a loss of confidentiality.

Classification

Location: Remote/Network Access Required
Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Exploit: Exploit Unavailable
Disclosure: OSVDB Verified

Solution

Upgrade to MailServer version 6.0.9 or higher, Personal Firewall version 4.1.3 or higher, and WinRoute Firewall version 6.0.11 or higher, as it has been reported to fix this vulnerability. It may also possible to protect against the flaw by implementing the following workaround: restrict access to the administrative ports in these products.

Products

Kerio Technologies, Inc.	WinRoute Firewall	6.0.8
		6.0.10
		6.0.1
		6.0.2
		6.0.3
		6.0.4
		6.0.5
		6.0.6
		6.0.7
		6.0.9
		6.0.0
	Personal Firewall	4.1.1
		4.1.0
		4.1.2
		4.0.x
	MailServer	6.0.7
		6.0.6
		6.0.5
		6.0.8
		6.0.4
		6.0.3
		6.0.1
		6.0.0
		6.0.2