Kerio/Tiny Firewall Vulnerability

Printable View

May 9th, 2003, 01:47 PM
Tiger Shark

Kerio/Tiny Firewall Vulnerability

This came over BugTraq Yesterday afternoon. I know that several of you use Tiny firewall so I thought you might like to know. I left off the links to the exploit itself but the fixes/patches links are in the text.

Quote:

Hello,

April 28, 2003, the CoreSecurity team publishes security advisory concerning 2 holes in Kiero Personal Firewall, of which one of both is Remote Buffer Overflow in the process of connection of the remote admin module.
Kiero Personal Firewall using PFEngine, an common firewall engine, it proves that the vulnerability is also present in Tiny Personal Firewall!
In the same time, every PFE firewall based products are vulnerable...

Today, the Thursday, May 8, 2003 6:27 PM, ThreaT (again@#!) from Skin Of Humanity Group released the exploit and the UNOFFICIAL patch for Kerio Personal Firewall version 2.1.4.0 (and previous versions) and Tiny Personal Firewall version 2.0.15.0.

Please enjoy sources of the patch at : http://www.s0h.cc/~threat/goodies/PF...es_PFpatch.zip

To correct this problem on your personnal firewall use this address : http://www.s0h.cc/~threat/goodies/PFpatch/PFpatch.exe
May 9th, 2003, 08:39 PM
t2k2

I just mentioned this to one of my cohorts and we noticed that it isn't verified. There is nothing even mentioned on the Kerio site. Maybe they are investigating it as we speak to see if it's valid????

Thanks.
May 9th, 2003, 08:55 PM
Tiger Shark

Er... Yeah..... This line was towards the end of the whole mail:-

Quote:

Sight that Kiero did not want to answer the CoreSecurity request, we did not inform Kerio. i think they do not understood what it passed. (no offence).

I'm not sure what he is trying to say here since his english is a little questionable. There were more than one group investigating this so it may mean that CoreSecurity informed them of one of the holes and that Kerio did not understand the vulnerability so that they haven't informed them of the second.

That's my take on it anyway.......

As always, be careful if you D/L the patch. You might want a packet sniffer on a test box to see what happens before you run it in production.
May 9th, 2003, 09:03 PM
t2k2

Yeah, I was thinkof d/ling the patch and looking at the source code if possible. Anyways, thanks for the post.
May 9th, 2003, 09:38 PM
foyap

I am using Kerio PF 3.0 beta 6, would like to know whether it was affected as what has been mentioned in the article. Version 3.0 is totally different with version 2.0 as it is more powerful, below is the link to the download page:

http://www.kerio.com/us/beta_section.html
May 10th, 2003, 08:00 AM
Lebb

PF hacks

have you thought of filing the holes yourself with hacks, though only a decent programmer could do that.
May 10th, 2003, 09:39 PM
journy101

Ive been useing Kerio Version 2 for alittle over a year now, thank you for the information and links. I visited the links, without blindly downloading patches I moved back a directory first to see what it was all about. I am going to wait a while to see Kerio's responce to this before I patch. I am always on edge with unoficial patches. But thanks so much.
May 11th, 2003, 04:03 AM
pak

Another Kerio vuln.

I recieved that alert along with another that stated packets with a source port of 53 comes through the firewall without going against the ruleset. Details can be read at http://www.securityfocus.com/bid/7436/discussion/
May 11th, 2003, 10:46 AM
Tim_axe

Thanks for the heads-up. I run TinyPersonal Firewall so this is important to me.

From what I've found out, it is a problem with remote administration, and one of the issues is some sort of a replay attack. Basicly, if someone captures the packets you send to the firewall to enable/disable some rules, then that person will be able to disable/enable those rules in the future by resending those packets. The other is a buffer overflow (as TigerShark mentioned). As long as you have remote-administration turned off, you shouldn't be affected by these vulnerabilities. I run Tiny on my home PC, so I don't need any remote-administration of my firewall. Anyways, thanks for this information.

-Tim_axe
May 12th, 2003, 12:48 PM
SirDice

Use the source luke

Found this:

http://www.packetstormsecurity.nl/fi...Exploit.c.html
May 12th, 2003, 02:23 PM
neel

About the exploit for kerio 2.1.4, kerio did release version 2.1.5 on 9 may...

Quote:

Release History

2.1.5 - May 9, 2003
- fixed security bug http://www.net-security.org/vuln.php?id=2649

You can download that one from the download section...

edit:
And as foyap already mensioned, there's a beta version 3

Quote:

enhanced packet filter - define unlimited number of protocols, services, address groups, time intervals, etc.
firewall can be configured by simply permitting or denying communication to applications - suitable for beginners and less experienced users who do not want to use the advanced packet filter
Intrusion Detection System
System Security - applications on the desktop protected against being rewritten, modified or misused by other applications, etc.
new status reports in the Advanced Admin - traffic chart, MS Networking status, etc.
many enhancements in performance and load on the memory, especially in the kernel part of the engine
completely re-vamped graphical user interface, simpler for less experienced users; advanced settings for experienced users available through the Advanced Admin

Sounds nice...