Kerio WinRoute Firewall, MailServer, and ServerFirewall use weak encryption
| kerio-weak-encryption (18470) |  Medium Risk |
Description:
Kerio WinRoute Firewall stores passwords in the configuration files using a weak encryption scheme. This could allow a local attacker to access these files and decrypt the passwords.
Consequences:
Obtain Information
Remedy:
For Kerio WinRoute Firewall:
Upgrade to the latest version (6.0.9 or later), as listed in Kerio Security Advisory KSEC-2004-12-14-01. See References.
For Kerio ServerFirewall:
Upgrade to the latest version (1.0.1 or later), as listed in Kerio Security Advisory KSEC-2004-12-14-01. See References.
For Kerio MailServer:
Upgrade to the latest version (6.0.5 or later), as listed in Kerio Security Advisory KSEC-2004-12-14-01. See References.
References:
- BugTraq Mailing List, Tue Dec 14 2004 - 04:00:48 CST : [CAN-2004-1022] Insecure Credential Storage on Kerio Software.
- Kerio Security Advisory KSEC-2004-12-14-01: Less secure credential storage.
- BID-11930: Multiple Kerio Products Universal Secret Key Storage Vulnerability
- CVE-2004-1022: Kerio Winroute Firewall before 6.0.7, ServerFirewall before 1.0.1, and MailServer before 6.0.5 use symmetric encryption for user passwords, which allows attackers to decrypt the user database and obtain the passwords by extracting the secret key from within the software.
Platforms Affected:
- Apple Mac OS X 10.2
- Apple Mac OS X 10.3
- FedoraProject Fedora Core 4
- Kerio Kerio MailServer prior to 6.0.5
- Kerio Kerio ServerFirewall prior to 1.0.1
- Kerio Kerio WinRoute Firewall prior to 6.0.7
- Microsoft Windows 2003 Server
- RedHat Enterprise Linux AS
- RedHat Linux 9.0
- SUSE SuSE Linux 9.0
Reported:
Dec 14, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net