Multiple Kerio Products Administration Console File Disclosure and Corruption Vulnerability

Bugtraq ID:	40505
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jun 01 2010 12:00AM
Updated:	Jun 02 2010 03:30PM
Credit:	Ji-Gang Wang
Vulnerable:	Kerio WinRoute Firewall 6.7.1 Kerio WinRoute Firewall 6.7 Kerio WinRoute Firewall 6.4.1 Kerio WinRoute Firewall 6.2.3 Kerio WinRoute Firewall 6.2.2 Kerio WinRoute Firewall 6.2.1 Kerio WinRoute Firewall 6.2 Kerio WinRoute Firewall 6.1.4 Patch 2 Kerio WinRoute Firewall 6.1.4 Patch 1 Kerio WinRoute Firewall 6.1.4 Kerio WinRoute Firewall 6.1.3 Kerio WinRoute Firewall 6.1.2 Kerio WinRoute Firewall 6.1.1 Kerio WinRoute Firewall 6.1 Kerio WinRoute Firewall 6.0.11 Kerio WinRoute Firewall 6.0.9 Kerio WinRoute Firewall 6.0.8 Kerio WinRoute Firewall 6.0.7 Kerio WinRoute Firewall 6.0.6 Kerio WinRoute Firewall 6.0.5 Kerio WinRoute Firewall 6.0.4 Kerio WinRoute Firewall 6.0.3 Kerio WinRoute Firewall 6.0.2 Kerio WinRoute Firewall 6.0.1 Kerio WinRoute Firewall 6.0 Kerio WinRoute Firewall 6.7.1 patch2 Kerio Mailserver 6.7.3 Kerio Mailserver 6.7 Kerio Mailserver 6.6.2 Kerio Mailserver 6.6.1 build 7069 Kerio Mailserver 6.6.1 Kerio Mailserver 6.6 Kerio Mailserver 6.5 Kerio Mailserver 6.4.2 Kerio Mailserver 6.4.1 Kerio Mailserver 6.3.1 Kerio Mailserver 6.2.2 Kerio Mailserver 6.1.3 Kerio Mailserver 6.0.10 Kerio Mailserver 6.0.9 Kerio Mailserver 6.0.5 Kerio Mailserver 6.0.4 Kerio Mailserver 6.0.3 Kerio Mailserver 6.0.2 Kerio Mailserver 6.0.1 Kerio Mailserver 6.0 Kerio Mailserver 6.7.0 Patch 1 Kerio Mailserver 6.6.2 Patch 3 Kerio Mailserver 6.1.3 Patch 1
Not Vulnerable:	Kerio WinRoute Firewall 7.0 Kerio Mailserver 7.0

Multiple Kerio Products Administration Console File Disclosure and Corruption Vulnerability

Multiple Kerio Products are prone to a file disclosure and corruption vulnerability.

An attacker can exploit this vulnerability to gain access to files and corrupt data on a vulnerable computer. This may aid in further attacks.

Kerio MailServer up to and including version 6.7.3 as well as Kerio WinRoute Firewall up to and including version 6.7.1 patch2 are affected.

Multiple Kerio Products Administration Console File Disclosure and Corruption Vulnerability

An attacker may exploit this issue through a web browser.

Multiple Kerio Products Administration Console File Disclosure and Corruption Vulnerability

Solution:
Updates are available. Please see the references for more information.

Multiple Kerio Products Administration Console File Disclosure and Corruption Vulnerability

References:

• Kerio Homepage (Kerio)
  
• KSEC-2010-06-01-01 (Kerio)