CVE-2004-1907: Low severity Kerio Personal Firewall vulnerability
Published Dec 31, 2004
·Updated
The Web Filtering functionality in Kerio Personal Firewall (KPF) 4.0.13 allows remote attackers to cause a denial of service (crash) by sending hex-encoded URLs containing "%13%12%13".
Affected Software
10 affected components
Kerio Personal Firewall=4.0.8
Kerio Personal Firewall=4.0.7
Kerio Personal Firewall=4.0.10
Kerio Personal Firewall=4.0.6
Kerio Personal Firewall=4.0.9
Kerio Personal Firewall=4.0.6
Kerio Personal Firewall=4.0.7
Kerio Personal Firewall=4.0.8
Kerio Personal Firewall=4.0.9
Kerio Personal Firewall=4.0.10
Event History
Dec 31, 2004
CVE Published
05:00 AM
May 10, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-1907?
CVE-2004-1907 is classified as a denial of service vulnerability.
2
How do I fix CVE-2004-1907?
To remediate CVE-2004-1907, upgrade Kerio Personal Firewall to a version that does not include the vulnerability.
3
Which versions of Kerio Personal Firewall are affected by CVE-2004-1907?
Kerio Personal Firewall versions 4.0.7, 4.0.8, 4.0.9, and 4.0.10 are vulnerable to CVE-2004-1907.
4
Can I still use Kerio Personal Firewall if I have CVE-2004-1907?
Using an affected version of Kerio Personal Firewall poses a risk of crashing the service, so it is advisable to upgrade.
5
What kind of attack does CVE-2004-1907 involve?
CVE-2004-1907 involves remote attackers sending specially crafted hex-encoded URLs to cause a service crash.