ID

VAR-200504-0069

CVE

CVE-2005-1063

TITLE

Kerio Management Port Denial of Service Vulnerability

DESCRIPTION

The administration protocol for Kerio WinRoute Firewall 6.x up to 6.0.10, Personal Firewall 4.x up to 4.1.2, and MailServer up to 6.0.8 allows remote attackers to cause a denial of service (CPU consumption) via certain attacks that force the product to "compute unexpected conditions" and "perform cryptographic operations.". Various Kerio products are vulnerable to a denial of service vulnerability with regards to the administration port. This issue is due to a failure of the application to properly handle exceptional conditions with regards to specifically malformed data. A remote attacker may leverage these issues, without requiring authentication, to exhaust resources on an affected computer, effectively denying service for legitimate users. The vendor has addressed this issue in Kerio MailServer 6.0.9, Kerio WinRoute Firewall 6.0.11, and Kerio Personal Firewall 4.1.3; earlier versions of these products are reported vulnerable. Kerio WinRoute Firewall is an enterprise-level firewall of American Kerio Company, which provides functions such as Internet sharing, virus protection and transparent proxy

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

EXTERNAL IDS

REFERENCES

CREDITS

Javier Munoz (Secure Computer Group) is credited with the discovery of this vulnerability.

SOURCES

LAST UPDATE DATE

2024-08-14T14:59:23.298000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE