Kerio WinRoute Firewall Disabled Account Bypass Vulnerability

Bugtraq ID:	15388
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 11 2005 12:00AM
Updated:	Nov 11 2005 12:00AM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Kerio WinRoute Firewall 6.1.2 Kerio WinRoute Firewall 6.1.1 Kerio WinRoute Firewall 6.1 Kerio WinRoute Firewall 6.0.11 Kerio WinRoute Firewall 6.0.9 Kerio WinRoute Firewall 6.0.8 Kerio WinRoute Firewall 6.0.7 Kerio WinRoute Firewall 6.0.6 Kerio WinRoute Firewall 6.0.5 Kerio WinRoute Firewall 6.0.4 Kerio WinRoute Firewall 6.0.3 Kerio WinRoute Firewall 6.0.2 Kerio WinRoute Firewall 6.0.1 Kerio WinRoute Firewall 6.0
Not Vulnerable:	Kerio WinRoute Firewall 6.1.3

Kerio WinRoute Firewall Disabled Account Bypass Vulnerability

Kerio WinRoute Firewall is prone to a vulnerability that could permit disabled accounts access. This issue is most likely due to an authentication error within the application.

Due to an unspecified error, disabled accounts can still authenticate to a vulnerable system. This may lead to a false sense of security.

Kerio WinRoute Firewall Disabled Account Bypass Vulnerability

No exploit is required.

Kerio WinRoute Firewall Disabled Account Bypass Vulnerability

Solution:
The vendor has addressed this issue in version 6.1.3. Users are advised to contact the vendor for details on obtaining the appropriate updates.

Kerio WinRoute Firewall Disabled Account Bypass Vulnerability

References:

• Kerio Homepage (Kerio)
  
• WinRoute Firewall Product Page (Kerio)
  
• WinRoute Firewall Release History (Kerio)