Kerio WinRoute Firewall, MailServer, and ServerFirewall insecure permissions
| kerio-insecure-permissions (18471) |  High Risk |
Description:
Kerio WinRoute Firewall has insecure permissions on the 'Program Files' system folder. A local attacker, that is a member of the 'Power Users' group, could perform operations, such as modifing program binary and configuration files or include a malicious DLL in the plug-ins folder.
Consequences:
Gain Privileges
Remedy:
For Kerio WinRoute Firewall:
Upgrade to the latest version (6.0.9 or later), as listed in Kerio Security Advisory KSEC-2004-12-14-01. See References.
For Kerio ServerFirewall:
Upgrade to the latest version (1.0.1 or later), as listed in Kerio Security Advisory KSEC-2004-12-14-01. See References.
For Kerio MailServer:
Upgrade to the latest version (6.0.5 or later), as listed in Kerio Security Advisory KSEC-2004-12-14-01. See References.
References:
- BugTraq Mailing List, Tue Dec 14 2004 - 04:08:25 CST: Insecure default file system permissions on Microsoft versions of Kerio Software.
- Kerio Security Advisory KSEC-2004-12-14-01: Less secure credential storage.
- CVE-2004-1023: Kerio Winroute Firewall before 6.0.9, ServerFirewall before 1.0.1, and MailServer before 6.0.5, when installed on Windows based systems, do not modify the ACLs for critical files, which allows local users with Power Users privileges to modify programs, install malicious DLLs in the plug-ins folder, and modify XML files related to configuration.
Platforms Affected:
- Apple Mac OS X 10.2
- Apple Mac OS X 10.3
- FedoraProject Fedora Core 4
- Kerio Kerio MailServer prior to 6.0.5
- Kerio Kerio ServerFirewall prior to 1.0.1
- Kerio Kerio WinRoute Firewall prior to 6.0.9
- Microsoft Windows 2003 Server
- RedHat Enterprise Linux AS
- RedHat Linux 9.0
- SUSE SuSE Linux 9.0
Reported:
Dec 14, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net