PT-2004-2021 · Kerio · Kerio Serverfirewall+2

Javier Munoz · Publicado 2004-12-15 · Atualizado 2017-07-11 · CVE-2004-1022

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Kerio Winroute Firewall versions prior to 6.0.7 Kerio ServerFirewall versions prior to 1.0.1 Kerio MailServer versions prior to 6.0.5

Description: The issue allows attackers to decrypt the user database and obtain passwords by extracting a secret key from within the software, due to the use of symmetric encryption for user passwords.

Recommendations: For Kerio Winroute Firewall versions prior to 6.0.7, update to version 6.0.7 or later to resolve the issue. For Kerio ServerFirewall versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. For Kerio MailServer versions prior to 6.0.5, update to version 6.0.5 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2004-1022

Produtos afetados

Kerio Mailserver

Kerio Serverfirewall

Kerio Winroute Firewall

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-1022 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18470 · Nota
• http://xforce.iss.net/xforce/xfdb/18470 · Nota
• http://securityfocus.com/bid/11930 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1022 · Nota
• http://marc.info/?l=bugtraq&m=110304957607578&w=2 · Nota
• http://marc.theaimsgroup.com/?l=bugtraq&m=110304957607578&w=2 · Nota