Kerio has acknowledged a vulnerability in Kerio Control and Kerio WinRoute Firewall, which can be exploited by malicious people to poison the HTTP cache.

The vulnerability is caused due to an unspecified error when processing HTTP data sent to a "non-HTTP" TCP connection. This can be exploited via a malicious website to e.g. store arbitrary data in the HTTP cache, which will then be served instead of legitimate content.

Successful exploitation requires that the HTTP cache is enabled (disabled by default).

The vulnerability is reported in all versions prior to Kerio Control version 7.1.0 Patch 1.

Solution
Update to Kerio Control version 7.1.0 Patch 1.
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://www.kerio.com/support/security-advisories#1012

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers