Results 1 to 3 of 3

Thread: *** Heads Up *** Kerio Firewall D0S Vulnerability

  1. #1
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197

    *** Heads Up *** Kerio Firewall D0S Vulnerability

    I know a lot of people here use this so you might want to consider downloading the fixed version. The impact isn't big on your home machine but if you use this to protect remote sites you will need to be physically at the machine to fix it after the D0S

    Kerio Personal Firewall Multiple IP Options Denial of Service

    Release Date:
    November 9, 2004

    Date Reported:
    October 30, 2004

    Severity:
    High (Remote Denial of Service)

    Vendor:
    Kerio

    Systems Affected:
    Kerio Personal Firewall 4.1.1 and prior

    Overview:
    eEye Digital Security has discovered a severe denial of service vulnerability in the Kerio Personal Firewall product for Windows. The vulnerability allows a remote attacker to reliably render a system inoperative with one single packet. Physical access is required in order to bring an affected system out of this "frozen" state. This specific flaw exists within the component that performs low level processing of TCP, UDP, and ICMP packets.

    Technical Details:
    The vulnerability exists in FWDRV.SYS when trying to parse through the IP Options in a TCP, UDP, or ICMP packet. When an attacker supplies a single TCP, UDP, or ICMP packet with an IP Option followed by a length of 0x00, the FWDRV.SYS driver enters an infinite loop and causes the operating system to "freeze up" to the point where it can no longer be accessed outside of the system itself nor can any part of the GUI be accessed including keyboard and mouse. The only way to bring the system back online is to hard boot the system which requires physical access of the system. The attacker only needs to send a single packet to any port on the system regardless of whether or not the port is open. This flaw is still accessible even if the firewall is set to "stop all traffic" because it still continues to process packets. The vulnerable code maintains an offset into the IP option bytes, and attempts to advance past a variable-length option by adding its length to the offset. If the option's length field is zero, then this will result in an infinite loop and the machine halts completely. It should be noted that since there is not a state requirement for performing this attack, it is possible to spoof a TCP, UDP, or ICMP packet. This results in an attacker's ability to remain anonymous.

    For those who pay attention you might have noticed that this vulnerability is _identical_ to the Symantec vulnerability we released a few months back. http://www.eeye.com/html/research/ad...D20040423.html This is important to illustrate as we hope that more software vendors become more diligent about reading the very important technical details held within advisories so that they can better secure their code/customers from already known attacks such as this one.

    Protection:
    Retina Network Security Scanner has been updated to identify this vulnerability.

    Vendor Status:
    Kerio has provided an update to their Personal Firewall 4. Please download 4.1.2 or later from http://www.kerio.com/kpf_download.html.
    Kerio has also released a security advisory at http://www.kerio.com/security_advisory.html.

    Credit:
    Discovery: Karl Lynn
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  2. #2
    Banned
    Join Date
    Aug 2001
    Location
    Yes
    Posts
    4,424
    Weird... I downloaded it and installed it. It's version 4.1.2 (9.50.98.0) as mentioned in the article, and was released on November 3rd... The log doesn't mention anything described in the article:


    - fixed problems with license registration
    - fixed bug in packet processing that can cause 100% CPU utilization
    - removed two IDS rules that block Microsoft Sharing on some configurations
    - more understandable IDS log view (prevents interchange of attack source with attack info source by users)

  3. #3
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    Neg:

    We need to have Mel teach you better english.....

    When an attacker supplies a single TCP, UDP, or ICMP packet with an IP Option followed by a length of 0x00, the FWDRV.SYS driver enters an infinite loop and causes the operating system to "freeze up" to the point where it can no longer be accessed outside of the system itself nor can any part of the GUI be accessed including keyboard and mouse. The only way to bring the system back online is to hard boot the system which requires physical access of the system.
    [/quote]- fixed bug in packet processing that can cause 100% CPU utilization[/quote]

    That's the freeze they talk about during packet processing.....
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •