PT-2004-3223 · Kerio · Kerio Personal Firewall

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2329

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Kerio Personal Firewall version 2.1.5

Description: The issue allows local users to execute arbitrary code with SYSTEM privileges. This is possible due to the Load button in the Firewall Configuration Files option not dropping privileges before opening the file loading dialog box.

Recommendations: For Kerio Personal Firewall version 2.1.5, consider restricting access to the Firewall Configuration Files option until a patch is available. As a temporary workaround, avoid using the Load button in the Firewall Configuration Files option to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2004-2329

Produtos afetados

Kerio Personal Firewall

Referências · 8

• 🔥 http://tuneld.com/news/?id=30 · Exploit
• 🔥 http://securitytracker.com/alerts/2004/Jan/1008870.html · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14981 · Nota
• http://tuneld.com/_images/other/kpf_system_privileges.png · Nota
• http://osvdb.org/3748 · Nota
• http://secunia.com/advisories/10746 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-2329 · Nota de Segurança
• http://securityfocus.com/bid/9525 · Nota