PT-2007-7243 · Kerio · Kerio Winroute Firewall

Published 2007-12-15 · Updated 2017-08-08 · CVE-2007-6385

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kerio WinRoute Firewall versions prior to 6.4.1

Description The issue concerns the proxy server in Kerio WinRoute Firewall, which does not properly enforce authentication for HTTPS pages. The impact and attack vectors of this issue are unknown, and it is unclear whether it crosses privilege boundaries.

Recommendations For versions prior to 6.4.1, update to version 6.4.1 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2007-6385

Affected Products

Kerio Winroute Firewall

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-6385 · Security Note
• http://secunia.com/advisories/28072 · Vendor Advisory
• http://kerio.com/kwf_history.html · Patch
• http://securityfocus.com/bid/26851 · Note
• http://vupen.com/english/advisories/2007/4212 · Note
• http://osvdb.org/42122 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6385 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39020 · Note
• http://securitytracker.com/id?1019095 · Note