Vulnerabilities: Kerio Personal Firewall Admin Interface Buffer Overflow and Replay Attack
*Highly critical
April 29, 2003
Two vulnerabilities have been discovered in Kerio Personal Firewall (KPF). Both vulnerabilities are associated with the remote administration interface.
1) There exists a boundary error during the handshake when a client connects to the remote administration interface. During the administrator authentication process the client sends a packet indicating the size of the following packet containing the administrator's key, which is sent afterwards. However, KPF doesn't check whether the indicated size of the following packet is correct, which can result in a buffer overflow.
Successful exploitation can result in execution of arbitrary code on the vulnerable system but requires that a malicious person can connect to the remote administration interface. However, the malicious person does not have to the authenticated.
2) It is possible for a malicious person to bypass the administrator authentication process due to an authentication error. A malicious person, who is able to monitor and capture traffic from an administrator to the firewall, can conduct a replay attack.
Successful exploitation allows the malicious person to perform the same actions as the ones performed by the administrator in the captured session.
Reportedly, Kerio Personal Firewall version 2.1.4 and prior are vulnerable.
