Kerio Winroute Firewall before 6.0.7, ServerFirewall before 1.0.1, and MailServer before 6.0.5 use symmetric encryption for user passwords, which allows attackers to decrypt the user database and obtain the passwords by extracting the secret key from within the software.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Kerio_mailserver | Kerio | 5.0 (including) | 5.0 (including) |
| Kerio_mailserver | Kerio | 5.1 (including) | 5.1 (including) |
| Kerio_mailserver | Kerio | 5.1.1 (including) | 5.1.1 (including) |
| Kerio_mailserver | Kerio | 5.6.3 (including) | 5.6.3 (including) |
| Kerio_mailserver | Kerio | 5.6.4 (including) | 5.6.4 (including) |
| Kerio_mailserver | Kerio | 5.6.5 (including) | 5.6.5 (including) |
| Kerio_mailserver | Kerio | 5.7.0 (including) | 5.7.0 (including) |
| Kerio_mailserver | Kerio | 5.7.1 (including) | 5.7.1 (including) |
| Kerio_mailserver | Kerio | 5.7.2 (including) | 5.7.2 (including) |
| Kerio_mailserver | Kerio | 5.7.3 (including) | 5.7.3 (including) |
| Kerio_mailserver | Kerio | 5.7.4 (including) | 5.7.4 (including) |
| Kerio_mailserver | Kerio | 5.7.5 (including) | 5.7.5 (including) |
| Kerio_mailserver | Kerio | 5.7.6 (including) | 5.7.6 (including) |
| Kerio_mailserver | Kerio | 5.7.7 (including) | 5.7.7 (including) |
| Kerio_mailserver | Kerio | 5.7.8 (including) | 5.7.8 (including) |
| Kerio_mailserver | Kerio | 5.7.9 (including) | 5.7.9 (including) |
| Kerio_mailserver | Kerio | 5.7.10 (including) | 5.7.10 (including) |
| Kerio_mailserver | Kerio | 6.0 (including) | 6.0 (including) |
| Kerio_mailserver | Kerio | 6.0.1 (including) | 6.0.1 (including) |
| Kerio_mailserver | Kerio | 6.0.2 (including) | 6.0.2 (including) |
| Kerio_mailserver | Kerio | 6.0.3 (including) | 6.0.3 (including) |
| Kerio_mailserver | Kerio | 6.0.4 (including) | 6.0.4 (including) |
| Serverfirewall | Kerio | 1.0 (including) | 1.0 (including) |
| Winroute_firewall | Kerio | 5.0.1 (including) | 5.0.1 (including) |
| Winroute_firewall | Kerio | 5.0.2 (including) | 5.0.2 (including) |
| Winroute_firewall | Kerio | 5.0.3 (including) | 5.0.3 (including) |
| Winroute_firewall | Kerio | 5.0.4 (including) | 5.0.4 (including) |
| Winroute_firewall | Kerio | 5.0.5 (including) | 5.0.5 (including) |
| Winroute_firewall | Kerio | 5.0.6 (including) | 5.0.6 (including) |
| Winroute_firewall | Kerio | 5.0.7 (including) | 5.0.7 (including) |
| Winroute_firewall | Kerio | 5.0.8 (including) | 5.0.8 (including) |
| Winroute_firewall | Kerio | 5.0.9 (including) | 5.0.9 (including) |
| Winroute_firewall | Kerio | 5.1 (including) | 5.1 (including) |
| Winroute_firewall | Kerio | 5.1.1 (including) | 5.1.1 (including) |
| Winroute_firewall | Kerio | 5.1.2 (including) | 5.1.2 (including) |
| Winroute_firewall | Kerio | 5.1.3 (including) | 5.1.3 (including) |
| Winroute_firewall | Kerio | 5.1.4 (including) | 5.1.4 (including) |
| Winroute_firewall | Kerio | 5.1.5 (including) | 5.1.5 (including) |
| Winroute_firewall | Kerio | 5.1.6 (including) | 5.1.6 (including) |
| Winroute_firewall | Kerio | 5.1.7 (including) | 5.1.7 (including) |
| Winroute_firewall | Kerio | 5.1.8 (including) | 5.1.8 (including) |
| Winroute_firewall | Kerio | 5.1.9 (including) | 5.1.9 (including) |
| Winroute_firewall | Kerio | 5.1.10 (including) | 5.1.10 (including) |
| Winroute_firewall | Kerio | 5.10 (including) | 5.10 (including) |
| Winroute_firewall | Kerio | 6.0 (including) | 6.0 (including) |
| Winroute_firewall | Kerio | 6.0.1 (including) | 6.0.1 (including) |
| Winroute_firewall | Kerio | 6.0.2 (including) | 6.0.2 (including) |
| Winroute_firewall | Kerio | 6.0.3 (including) | 6.0.3 (including) |
| Winroute_firewall | Kerio | 6.0.4 (including) | 6.0.4 (including) |
| Winroute_firewall | Kerio | 6.0.5 (including) | 6.0.5 (including) |
| Winroute_firewall | Kerio | 6.0.6 (including) | 6.0.6 (including) |
| Winroute_firewall | Kerio | 6.0.7 (including) | 6.0.7 (including) |
| Winroute_firewall | Kerio | 6.0.8 (including) | 6.0.8 (including) |
References
- http://marc.info/?l=bugtraq\u0026m=110304957607578\u0026w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18470
- http://marc.info/?l=bugtraq\u0026m=110304957607578\u0026w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18470