CVE-2004-1022: Low severity Kerio Kerio MailServer vulnerability
Kerio Winroute Firewall before 6.0.7, ServerFirewall before 1.0.1, and MailServer before 6.0.5 use symmetric encryption for user passwords, which allows attackers to decrypt the user database and obtain the passwords by extracting the secret key from within the software.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2004-1022?
CVE-2004-1022 is rated as a medium severity vulnerability due to the potential for password decryption.
How do I fix CVE-2004-1022?
To mitigate CVE-2004-1022, upgrade to Kerio Winroute Firewall version 6.0.7, Kerio ServerFirewall version 1.0.1, or Kerio MailServer version 6.0.5 or later.
Which versions of software are affected by CVE-2004-1022?
CVE-2004-1022 affects Kerio Winroute Firewall versions prior to 6.0.7, ServerFirewall prior to 1.0.1, and MailServer prior to 6.0.5.
What types of attacks can exploit CVE-2004-1022?
CVE-2004-1022 can be exploited by attackers to decrypt the user database and obtain passwords.
What are the implications of CVE-2004-1022 for system security?
CVE-2004-1022 allows unauthorized access to user credentials, potentially leading to compromised accounts and broader security breaches.