Kerio Personal Firewall IP Options Denial Of Service Vulnerability

Bugtraq ID:	11639
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Nov 09 2004 12:00AM
Updated:	Nov 09 2004 12:00AM
Credit:	Discovery of this issue is credited to Karl Lynn.
Vulnerable:	Kerio Personal Firewall 4.1.1 Kerio Personal Firewall 4.1 Kerio Personal Firewall 4.0.16 Kerio Personal Firewall 4.0.10 Kerio Personal Firewall 4.0.9 Kerio Personal Firewall 4.0.8 Kerio Personal Firewall 4.0.7 Kerio Personal Firewall 4.0.6
Not Vulnerable:	Kerio Personal Firewall 4.1.2

Kerio Personal Firewall IP Options Denial Of Service Vulnerability

A remote denial of service vulnerability affects the IP options filtering functionality of Kerio's Personal Firewall. This issue is caused by a failure of the application to properly handle malformed network packets.

A remote attacker can exploit this issue anonymously with a spoofed packet to cause a computer running the affected application to hang indefinitely, denying service to legitimate users.

Kerio Personal Firewall IP Options Denial Of Service Vulnerability

No exploit is required to leverage this issue.

A proof of concept exploit has been provided by .::[ houseofdabus ]::.

• /data/vulnerabilities/exploits/HOD-kerio-firewall-DoS-expl.c

Kerio Personal Firewall IP Options Denial Of Service Vulnerability

Solution:
The vendor has released an upgrade dealing with this issue.


Kerio Personal Firewall 4.0.10

• Kerio Kerio Personal Firewall 4.1.2
  http://download.kerio.com/dwn/kpf4-en-win.exe

Kerio Personal Firewall 4.0.16

• Kerio Kerio Personal Firewall 4.1.2
  http://download.kerio.com/dwn/kpf4-en-win.exe

Kerio Personal Firewall 4.0.6

• Kerio Kerio Personal Firewall 4.1.2
  http://download.kerio.com/dwn/kpf4-en-win.exe

Kerio Personal Firewall 4.0.7

• Kerio Kerio Personal Firewall 4.1.2
  http://download.kerio.com/dwn/kpf4-en-win.exe

Kerio Personal Firewall 4.0.8

• Kerio Kerio Personal Firewall 4.1.2
  http://download.kerio.com/dwn/kpf4-en-win.exe

Kerio Personal Firewall 4.0.9

• Kerio Kerio Personal Firewall 4.1.2
  http://download.kerio.com/dwn/kpf4-en-win.exe

Kerio Personal Firewall 4.1

• Kerio Kerio Personal Firewall 4.1.2
  http://download.kerio.com/dwn/kpf4-en-win.exe

Kerio Personal Firewall 4.1.1

• Kerio Kerio Personal Firewall 4.1.2
  http://download.kerio.com/dwn/kpf4-en-win.exe

Kerio Personal Firewall IP Options Denial Of Service Vulnerability

References:

• Kerio Homepage (Kerio)
  
• KSEC-2004-11-04-01 - Malicious packet can cause 100% utilization and freeze (Kerio)
  
• Personal Firewall Download Page (Kerio)
  
• EEYE: Kerio Personal Firewall Multiple IP Options Denial of Service ("Marc Maiffret" )