Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Kerio Personal Firewall can freeze from crafted network packets

CVE-2004-1109 · published 21 years ago
Summary

The firewall's driver in version 4.1.1 and earlier can be triggered by a specially made TCP, UDP or ICMP packet that has an empty option field. When this happens the computer may use all its processing power and become unresponsive. Updating to a newer version or applying the vendor's patch stops the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
kerio personal_firewall 4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.16
4.1
4.1.1
cpe:2.3:a:kerio:personal_firewall:4.0.6:*:*:*:*:*:*:*
Original advisory text
The FWDRV.SYS driver in Kerio Personal Firewall 4.1.1 and earlier allows remote attackers to cause a denial of service (CPU consumption and system freeze from infinite loop) via a (1) TCP, (2) UDP,...
The FWDRV.SYS driver in Kerio Personal Firewall 4.1.1 and earlier allows remote attackers to cause a denial of service (CPU consumption and system freeze from infinite loop) via a (1) TCP, (2) UDP, or (3) ICMP packet with a zero length IP Option field.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
3% chance of attack within 30 days
Timeline
Published10 Jan 2005
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2004-1109 · NVD
Track software like this
Free during beta