PT-2005-2081 · Kerio · Kerio Personal Firewall+2

Published 2005-04-29 · Updated 2011-03-08 · CVE-2005-1062

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Kerio WinRoute Firewall versions 6.x up to 6.0.10 Kerio Personal Firewall versions 4.x up to 4.1.2 Kerio MailServer versions up to 6.0.8

Description The issue allows remote attackers to quickly obtain passwords that are 5 characters or less via brute force methods. It is also possible to gain access to plain text passwords when an attacker knows at least one valid password and can connect to the remote administration port. This may lead to a loss of confidentiality, especially for passwords shorter than 6 characters.

Recommendations For Kerio WinRoute Firewall versions 6.x up to 6.0.10, consider disabling remote administration until a fix is available. For Kerio Personal Firewall versions 4.x up to 4.1.2, restrict access to the remote administration port to minimize the risk of exploitation. For Kerio MailServer versions up to 6.0.8, avoid using short passwords and limit connections to the remote administration port.

Fix

Related Identifiers

CVE-2005-1062

Affected Products

Kerio Mailserver

Kerio Personal Firewall

Kerio Winroute Firewall

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-1062 · Security Note
• http://kerio.com/security_advisory.html · Vendor Advisory
• http://research.tic.udc.es/scg/advisories/20050429-1.txt · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1062 · Note
• http://securityfocus.com/archive/1/397221 · Note