Secunia

Two vulnerabilities have been reported in Kerio Personal Firewall (KPF), which can be exploited by malicious people to bypass certain security restrictions or to compromise a vulnerable system.

1) A boundary error exists within the remote administration interface when processing handshake requests. This can be exploited to cause a buffer overflow via two specially crafted handshake packets, the first packet specifying an incorrect size for the second packet.

Successful exploitation allows execution of arbitrary code, but requires that a malicious person can connect to the remote administration interface.

2) An authentication error within the remote administration interface can be exploited to gain administrative access to the interface via replay attacks.

The vulnerabilities are reported in version 2.1.4. Prior versions may also be affected.

Solution
Update to version 2.1.5 or later, which fixes vulnerability #1.
Further details available in Customer Area

Provided and/or discovered by
Emiliano Kargieman, Hernán Gips, and Javier Burroni from Core Security Technologies.

Changelog
Further details available in Customer Area

Original Advisory
http://www.coresecurity.com/common/showdoc.php?idx=314&idxseccion=10

Deep Links
Links available in Customer Area