[VulnWatch] [CAN-2005-1062] Administration protocol abuse allows local/remote password cracking

From: Secure Computer Group (scg_at_udc.es)
Date: 04/29/05

  • Next message: Secure Computer Group: "[VulnWatch] [CAN-2005-1063] Administration protocol abuse leads to Service and System Denial of Service"
    Date: Fri, 29 Apr 2005 10:42:26 +0200
    To: vulnwatch@vulnwatch.org


                Secure Computer Group - University of A Coruna

                                   -- x --

               dotpi.com Information Technologies Research Labs


    ID: #20050429-1
    Document title: Administration protocol abuse allows
                                local/remote password cracking
    Document revision: 1.0

    Coordinated release date: 2005/04/29
    Vendor Acknowledge date: 2005/02/25
    Reported date: 2005/02/21

    CVE Name: CAN-2005-1062

    Other references: N/A


       Impact: Local/remote password cracking

       Rating/Severity: Medium
       Recommendation: Update to latest version
                                Enforce network ACLs
                                Enforce password policies

       Vendor: Kerio Technologies Inc.

       Affected software:

                  o Kerio WinRoute Firewall up to and including 6.0.10

                  o Kerio Personal Firewall up to and including 4.1.2

                  o Kerio MailServer up to and including 6.0.8

       Updates/Patches: Yes (see below)

    General Information:

       1. Executive summary:

          Kerio WinRoute Firewall, Kerio Personal Firewall and Kerio
          MailServer drive a local/remote administration protocol in order
          to manage the service.

          This protocol can be abused in order to remotely retrieve user
          credentials through a brute forcing technique. Passwords 1-5
          characters long could be obtained quickly. As such, Kerio considers
          them insecure and recommends enforcing password policies. The
          attack is not practically usable for passwords longer than 5
          characters. User logins must be previously known for this attack to
          be successful.

          The logging component of the software can loose up to 40% of the
          events when the attack is in place.

          In order solve this problem, system administrators should enforce
          network ACL security settings and user password policies. It is
          also highly recommended to verify this settings as part of the
          planning, installation, hardening and auditing processes.

          New versions of the software solve this and other minor problems
          so an upgrade is highly recommended.

       2. Technical details:

          Technical details and proof of concept code were provided to

       3. Risk Assessment factors:

          The attacker should have access to the administration ports:

            o TCP/UDP 44333 - Kerio WinRoute Firewall Administration

            o TCP/UDP 44334 - Kerio Personal Firewall Administration

            o TCP/UDP 44337 - Kerio MailServer Administration

          Network effective bandwidth between the system and the attacker is
          also an important speed and success factor.

          User logins must be previously known or previously brute forced
          for this attack to be successful.

          Special attention should be taken on environments on which NT,
          Active Directory or Open Directory integration is in place.
          GINA.DLL re-login delay features are bypassed and therefore the
          brute forcing procedure is considerably quicker.

          Local/Domain User Lock-out policies can help on contenting this
          attack. Despite that, an user login denial of service can emerge
          as a side effect.

          The most risky scenarios are the ones in which the server machine
          is shared among two or more interactive users/administrators or
          those situations where Kerio service management have been
          delegated to a third party.

          The weakeness on the logging facility can be a target on its own
          in order to hide any other attack that is being performed

          Special care should be taken on such environments and every step
          of the project: design, planning, deployment and management
          should consider this security issues.

          Privilege escalation, system and software tampering and the
          ability to alter service configuration are all real issues and
          all of them can be used as a second stage attack vector.

       4. Solutions and recommendations:

          Upgrade to the latest versions:

             o Kerio Winroute Firewall 6.0.11 and above

             o Kerio Personal Firewall 4.1.3 and above

             o Kerio MailServer 6.0.9 and above

          As in any other case, follow, as much as possible, the Industry
          'Best Practices' on Planning, Deployment and Operation on this
          kind of services.

       5. Common Vulnerabilities and Exposures (CVE) project:

          The Common Vulnerabilities and Exposures (CVE) project has
          assigned the name CAN-2005-1062 to this issue. This is a
          candidate for inclusion in the CVE list (http://cve.mitre.org),
          which standardizes names for security problems.



       1. Special thanks to Vladimir Toncar and the whole Technical Team from
          Kerio Technologies (support at kerio.com) for their quick response
          and professional handling on this issue.

       3. The whole Research Lab at dotpi.com and specially to Carlos Veira.

       3. Secure Computer Group at University of A Coruna (scg at udc.es),
          and specially to Antonino Santos del Riego.



       Javier Munoz (Secure Computer Group) is credited with this discovery.


    Related Links:

       [1] Kerio Technologies Inc.

       [2] Kerio WinRoute Firewall Downloads & Updates

       [3] Kerio Personal Firewall Downloads & Updates

       [4] Kerio MailServer Downloads & Updates

       [5] Secure Computer Group. University of A Coruna

       [6] Secure Computer Group. Updated advisory

       [7] dotpi.com Information Technologies S.L.

       [8] dotpi.com Research Labs


    Legal notice:

       Copyright (c) 2002-2005 Secure Computer Group. University of A Coruna
       Copyright (c) 2004-2005 dotpi.com Information Technologies S.L.

       Permission is granted for the redistribution of this alert
       electronically. It may not be edited in any way without the express
       written consent of the authors.

       If you wish to reprint the whole or any part of this alert in any
       other medium other than electronically, please contact the authors
       for explicit written permission at the following e-mail addresses:
       (scg at udc.es) and (info at dotpi.com).

       Disclaimer: The information in the advisory is believed to be
       accurate at the time of publishing based on currently available
       information. Use of the information constitutes acceptance for use
       in an AS IS condition.

       There are no warranties with regard to this information. Neither the
       author nor the publisher accepts any liability for any direct,
       indirect, or consequential loss or damage arising from use of, or
       reliance on, this information.

  • Next message: Secure Computer Group: "[VulnWatch] [CAN-2005-1063] Administration protocol abuse leads to Service and System Denial of Service"

    Relevant Pages