PT-2004-2021 · Kerio · Kerio Serverfirewall+2

Javier Munoz · Published 2004-12-15 · Updated 2017-07-11 · CVE-2004-1022

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Kerio Winroute Firewall versions prior to 6.0.7 Kerio ServerFirewall versions prior to 1.0.1 Kerio MailServer versions prior to 6.0.5

Description: The issue allows attackers to decrypt the user database and obtain passwords by extracting a secret key from within the software, due to the use of symmetric encryption for user passwords.

Recommendations: For Kerio Winroute Firewall versions prior to 6.0.7, update to version 6.0.7 or later to resolve the issue. For Kerio ServerFirewall versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. For Kerio MailServer versions prior to 6.0.5, update to version 6.0.5 or later to resolve the issue.

Fix

Related Identifiers

CVE-2004-1022

Affected Products

Kerio Mailserver

Kerio Serverfirewall

Kerio Winroute Firewall

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-1022 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18470 · Note
• http://xforce.iss.net/xforce/xfdb/18470 · Note
• http://securityfocus.com/bid/11930 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1022 · Note
• http://marc.info/?l=bugtraq&m=110304957607578&w=2 · Note
• http://marc.theaimsgroup.com/?l=bugtraq&m=110304957607578&w=2 · Note