ghost16825
Use security metrics
Premium
join:2003-08-26
| [Kerio 2.x] Ports open in all versions of Kerio 2.15!
This is an offshoot from this thread:
»[Kerio 4.x] port 44334 is OPEN: BIG SECURITY HOLE
said by the viper  :
I did a full port scann 1- 65535 lol while i ate Turkey , and this was the result w/ KPF 4.008 ids on and rule set from Blitzen from 2.1.5...
Port: Status Service Description
1-1970 stealthed n/a n/a
1972-2175 stealthed n/a n/a
2177-44333 stealthed n/a n/a
44335-65535 stealthed n/a n/a
1971 closed n/a n/a
2176 closed n/a n/a
44334 open n/a n/a
Recommendation:
These ports are open/closed on 2.15 as well!
1)Can anyone else confirm this, using the latest one available for download?
2)Can anyone with nmap check these specific ports if you have 2.15 and send in the results. What operating system does the nmap come up with? |
|
gwion
wild colonial boy
Premium,ExMod 2001-08
join:2000-12-28
Pittsburgh, PA
| see: »[Kerio 4.x] port 44334 is OPEN: BIG SECURITY HOLE
 - I SYN scanned 2.1.5 in the following configs... this is with my own ruleset:
Remote allowed/block all inbounds rule active: Blocked by inbounds rule. Returns stealthed.
Remote allowed/no block all inbounds rule:alerts, and, on deny, returns stealthed.
Remote not allowed/block all inbounds rule active: same as above.
Remote not allowed/no block all inbounds rule: same as above.
Evidently, they've lost something, in 4.x... uhhh... a sound implementation of the administrative interface. 
--
The willow bends unbroken when angry tempests blow,The stately oak is levelled and all its strength laid low...Oliver Wendell Holmes
Even when you feel like your life is fading
I know that you'll go on forever
You're that good... |
|
BlitzenZeus
Burnt Out Cynic
Premium,MVM
join:2000-01-13
Beaverton, OR | reply to ghost16825
Re: [Kerio 2.x] Ports open in all versions of Keri
I'm also completely stealth with Kerio 2x. If you use the gateway option you need to use a block all rule. |
|
ghost16825
Use security metrics
Premium
join:2003-08-26 | reply to ghost16825
Yes, you're both completely correct. 2.15 does stealth all ports. I was a bit hasty to reach a conclusion running the firewall in a half protected state. |
|
