Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Firewall)  >   Kerio Personal Firewall Vendors:   Kerio Technologies
Kerio Personal Firewall Administration Port Lets Remote Users Deny Service
SecurityTracker Alert ID:  1013850
SecurityTracker URL:
CVE Reference:   CVE-2005-1063   (Links to External Site)
Date:  Apr 30 2005
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.1.2 and prior versions
Description:   A vulnerability was reported in Kerio Personal Firewall. A remote user can cause denial of service conditions via the remote administration port.

A remote user connect to the administration port (44334) and supply specially crafted data to cause denial of service conditions. A remote user can also exceed the maximum number of allowed simultaneous connections to cause denial of service conditions.

The attack is not logged.

Secure Computer Group and Information Technologies Research Labs reported this vulnerability. Javier Munoz (Secure Computer Group) discovered this vulnerability.

Impact:   A remote user can cause denial of service conditions.
Solution:   The vendor has issued a fixed version (4.1.3), available at:

Vendor URL: (Links to External Site)
Cause:   Exception handling error, State error
Underlying OS:  Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  [CVE-2005-1063] Administration protocol abuse leads to Service and


            Secure Computer Group - University of A Coruna

                               -- x --

  Information Technologies Research Labs


ID:                        #20050429-2
Document title:            Administration protocol abuse leads to
                            Service and System Denial of Service
Document revision:         1.0

Coordinated release date:  2005/04/29
Vendor Acknowledge date:   2005/02/25
Reported date:             2005/02/21

CVE Name:                  CAN-2005-1063

Other references:          N/A


   Impact:                  Service denial of service (DoS)
                            CPU hogging denial of service (DoS)

   Rating/Severity:         Medium
   Recommendation:          Update to latest version
                            Enforce network ACLs

   Vendor:                  Kerio Technologies Inc.

   Affected software:

              o Kerio WinRoute Firewall up to and including 6.0.10

              o Kerio Personal Firewall up to and including 4.1.2

              o Kerio MailServer up to and including 6.0.8

   Updates/Patches:         Yes (see below)

General Information:

   1. Executive summary:

      Kerio WinRoute Firewall, Kerio Personal Firewall and Kerio
      MailServer drive a local/remote administration protocol in order
      to manage the service.

      This protocol can be abused in pre-authentication states forcing
      the service to compute unexpected conditions and also to perform
      cryptographic operations over each protocol message.

      As a result, system resources get exhausted and the system
      becomes unresponsive. A sufficient network bandwidth between the
      system and the attacker is required for the attack.

      It must be noted that the limit of maximun number of user
      connections can also be used to perform a service denial of
      service and that no valid authentication is required for this to

      The logging component of the software ignores any event related
      with this attack.

      In order solve this problem, system administrators should enforce
      network ACL security settings. It is also highly recommended to
      verify this settings as part of the planning, installation,
      hardening and auditing processes.

      New versions of the software solve this and other minor problems
      so an upgrade is highly recommended.

   2. Technical details:

      Technical details and proof of concept code were provided to

   3. Risk Assessment factors:

      The attacker should have access to the administration ports:

        o TCP/UDP 44333 - Kerio WinRoute Firewall Administration

        o TCP/UDP 44334 - Kerio Personal Firewall Administration

        o TCP/UDP 44337 - Kerio MailServer Administration

      The most risky scenarios are the ones in which the server machine
      is shared among two or more interactive users/administrators or
      those situations where Kerio service management have been
      delegated to a third party.

      Special care should be taken on such environments and every step
      of the project: design, planning, deployment and management
      should consider this security issues.

   4. Solutions and recommendations:

      Upgrade to the latest versions:

         o Kerio Winroute Firewall 6.0.11 and above

         o Kerio Personal Firewall 4.1.3 and above

         o Kerio MailServer 6.0.9 and above

      As in any other case, follow, as much as possible, the Industry
      'Best Practices' on Planning, Deployment and Operation on this
      kind of services.

   5. Common Vulnerabilities and Exposures (CVE) project:

      The Common Vulnerabilities and Exposures (CVE) project has
      assigned the name CAN-2005-1063 to this issue. This is a
      candidate for inclusion in the CVE list (,
      which standardizes names for security problems.



   1. Special thanks to Vladimir Toncar and the whole Technical Team from
      Kerio Technologies (support at for their quick response
      and professional handling on this issue.

   3. The whole Research Lab at and specially to Carlos Veira.

   3. Secure Computer Group at University of A Coruna (scg at,
      and specially to Antonino Santos del Riego.



   Javier Munoz (Secure Computer Group) is credited with this discovery.


Related Links:

   [1] Kerio Technologies Inc.

   [2] Kerio WinRoute Firewall Downloads & Updates

   [3] Kerio Personal Firewall Downloads & Updates

   [4] Kerio MailServer Downloads & Updates

   [5] Secure Computer Group. University of A Coruna

   [6] Secure Computer Group. Updated advisory

   [7] Information Technologies S.L.

   [8] Research Labs


Legal notice:

   Copyright (c) 2002-2005 Secure Computer Group. University of A Coruna
   Copyright (c) 2004-2005 Information Technologies S.L.

   Permission is granted for the redistribution of this alert
   electronically. It may not be edited in any way without the express
   written consent of the authors.

   If you wish to reprint the whole or any part of this alert in any
   other medium other than electronically, please contact the authors
   for explicit written permission at the following e-mail addresses:
   (scg at and (info at

   Disclaimer: The information in the advisory is believed to be
   accurate at the time of publishing based on currently available
   information. Use of the information constitutes acceptance for use
   in an AS IS condition.

   There are no warranties with regard to this information. Neither the
   author nor the publisher accepts any liability for any direct,
   indirect, or consequential loss or damage arising from use of, or
   reliance on, this information.


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC