Kerio Personal Firewall Web Filtering Remote Denial Of Service Vulnerability

Bugtraq ID:	10075
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 07 2004 12:00AM
Updated:	Apr 07 2004 12:00AM
Credit:	Discovery of this vulnerability has been credited to "E.Kellinis" <[email protected]>.
Vulnerable:	Kerio Personal Firewall 4.0.10 Kerio Personal Firewall 4.0.9 Kerio Personal Firewall 4.0.8 Kerio Personal Firewall 4.0.7 Kerio Personal Firewall 4.0.6
Not Vulnerable:

Kerio Personal Firewall Web Filtering Remote Denial Of Service Vulnerability

Kerio Personal Firewall includes Web URI Filtering functionality. A denial of service vulnerability has been reported to affect Kerio Personal Firewall when Web Filtering functionality is enabled. The issue presents itself when Web Filtering procedures handle a URI that contains certain characters.

Kerio Personal Firewall Web Filtering Remote Denial Of Service Vulnerability

There is no exploit required; however the following example has been provided:

http://www.example.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=^S^R^S

Kerio Personal Firewall Web Filtering Remote Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Kerio Personal Firewall Web Filtering Remote Denial Of Service Vulnerability

References:

• Kerio Homepage (Kerio)
  
• Kerio Personal Firewall 4 and IE 6 "Bug" ("E.Kellinis" )