GFI Forums: Kerio Connect » Kerio Connect and OpenSSL vulnerabilty CVE-2014-0160 (Heartbleed)

Home » GFI User Forums » Kerio Connect » Kerio Connect and OpenSSL vulnerabilty CVE-2014-0160 (Heartbleed) (Fixed in version 8.2.4. Hotfix: http://goo.gl/filNif)

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Switch to threaded view of this topic

Create a new topic

Submit Reply

Kerio Connect and OpenSSL vulnerabilty CVE-2014-0160 (Heartbleed) [message #112317]

Tue, 08 April 2014 13:47

Pavel Dobry (Kerio) is currently offline

Pavel Dobry (Kerio)
Messages: 2057
Registered: October 2003
Location: Czech Republic

OpenSSL vulnerabilty CVE-2014-0160 (Heartbleed)

Details:
Vulnerability has been reported in OpenSSL 1.0.1 and higher. It allows an attacker to read arbitrary data from the process memory.

Affected versions:
Kerio Connect 8.2.0 - 8.2.3.

Not affected (safe) versions:
Kerio Connect 8.1.3 and older.

Solution:
Kerio released a Kerio Connect 8.2.4 update (http://forums.kerio.com/t/27057//) for this vulnerability.

A hotfix is available at http://goo.gl/filNif for older Kerio Connect versions.

Description in Kerio KnowledgeBase: http://kb.kerio.com/1585

Knowledge Base: http://manuals.gfi.com/en/kerio/home/Content/Home.htm.

[Updated on: Tue, 08 August 2017 19:26] by Moderator

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0186 (Heartbleed) [message #112342 is a reply to message #112317]

Tue, 08 April 2014 17:24

Pavel Dobry (Kerio) is currently offline

Pavel Dobry (Kerio)
Messages: 2057
Registered: October 2003
Location: Czech Republic

Update:

A hotfix for all Kerio Connect 8.2.0-8.2.3 versions is now being tested. It will be available within few hours for our customers.
Also a Kerio Connect 8.2.4 update will follow few hours after the hotfix.

Knowledge Base: http://manuals.gfi.com/en/kerio/home/Content/Home.htm.

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0186 (Heartbleed) [message #112344 is a reply to message #112342]

Tue, 08 April 2014 17:34

Maerad is currently offline

Maerad
Messages: 275
Registered: August 2013

Can you give a rough eta for the hotfix? Like "might be available in ~4 h"?

[EDIT]
Gives the ppl here a better way to plan their maintenance or in my case, if I can wait for tonight and install it or if I should get up at the early morning

[Updated on: Tue, 08 April 2014 17:36]

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0186 (Heartbleed) [message #112348 is a reply to message #112344]

Tue, 08 April 2014 19:09

chrwei is currently offline

chrwei
Messages: 186
Registered: October 2009

is Control also affected?

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0186 (Heartbleed) [message #112349 is a reply to message #112348]

Tue, 08 April 2014 19:14

Jeeves_ is currently offline

Jeeves_
Messages: 23
Registered: May 2010
Location: Ede, NL

At first I thought so. But it doesn't look like it.

Offering Kerio and much more. See http://www.tuxis.nl and http://www.kerioindecloud.nl/

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0186 (Heartbleed) [message #112350 is a reply to message #112349]

Tue, 08 April 2014 19:23

Pavel Dobry (Kerio) is currently offline

Pavel Dobry (Kerio)
Messages: 2057
Registered: October 2003
Location: Czech Republic

Update:

Hotfix is available at http://goo.gl/filNif

A regular product service release will follow soon. Please report any problem with a hotfix here.
Thank you.

Knowledge Base: http://manuals.gfi.com/en/kerio/home/Content/Home.htm.

[Updated on: Wed, 09 April 2014 13:28]

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0186 (Heartbleed) [message #112352 is a reply to message #112350]

Tue, 08 April 2014 19:42

chrwei is currently offline

chrwei
Messages: 186
Registered: October 2009

applied, no "bad things" yet, so that's good.

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0186 (Heartbleed) [message #112353 is a reply to message #112352]

Tue, 08 April 2014 19:51

Vink is currently offline

Vink
Messages: 15
Registered: September 2007

Applied to a small Connect server (20 mailboxes). No problems so far.
Waiting a little bit longer to apply to larger (130 mailboxes) server.
Servers: Debian Wheezy, 64-bit. Connect 8.2.2 with AV & AS.

Edit: applied to larger server. Runs smoothly so far.

[Updated on: Tue, 08 April 2014 20:15]

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0186 (Heartbleed) [message #112354 is a reply to message #112353]

Tue, 08 April 2014 20:03

bmdv
Messages: 53
Registered: June 2004
Location: Germany

The fix works fine here with 8.2.3 (Ubuntu 12.04/64) and fixes the Vulnerability for us. Thanks.
Btw. a normal download link would be fine, so linux users can use wget to Download it directly to the Server.

[Updated on: Tue, 08 April 2014 20:03]

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0186 (Heartbleed) [message #112355 is a reply to message #112350]

Tue, 08 April 2014 20:12

s2igmbh is currently offline

s2igmbh
Messages: 1
Registered: April 2014

Pavel, the fix is working here on 64bit Debian7 Connect 8.2.3. Thanks a lot, s2igmbh

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0160 (Heartbleed) [message #112356 is a reply to message #112317]

Tue, 08 April 2014 21:20

BLTomato is currently offline

BLTomato
Messages: 33
Registered: April 2007

Shows up as clear now on an 8.2.2 install. Thanks guys!

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0160 (Heartbleed) [message #112360 is a reply to message #112317]

Tue, 08 April 2014 21:59

areichmann is currently offline

areichmann
Messages: 120
Registered: December 2012

Ok with multiple X64 Windows Versions.

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0160 (Heartbleed) [message #112361 is a reply to message #112360]

Tue, 08 April 2014 22:06

Pavel Dobry (Kerio) is currently offline

Pavel Dobry (Kerio)
Messages: 2057
Registered: October 2003
Location: Czech Republic

Thank you all for feedback!

Please share this information on Twitter, Facebook or whatever social tool you like. This vulnerability is quite serious and affects more than a half of all internet applications and servers. Servers must be patched as soon as possible.
The hotfix is for free for all affected Kerio Connect customers, even for customers not eligible for Kerio Connect updates.

Knowledge Base: http://manuals.gfi.com/en/kerio/home/Content/Home.htm.

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0160 (Heartbleed) [message #112366 is a reply to message #112317]

Tue, 08 April 2014 22:25

freakinvibe is currently offline

freakinvibe
Messages: 588
Registered: April 2004

Windows Server 2012 R2
Kerio Connect 8.2.2 32-bit

All went fine, vulnerability test now shows "not vulnerable".

Thanks for the quick fix.

Dexion Services AG - IT Support Services in Basel, Switzerland
https://dexionag.ch

Report message to a moderator

Send a private message to this user

Re: Kerio Connect and OpenSSL vulnerabilty CVE-2014-0160 (Heartbleed) [message #112370 is a reply to message #112366]

Tue, 08 April 2014 23:05

b-tom is currently offline

b-tom
Messages: 184
Registered: January 2006

Flawless hot fix upgrade on macosx server. No longer vulnerable. Thanks Pavel.

Report message to a moderator

Send a private message to this user

Pages (4): [1 2 3 4 › »]

Switch to threaded view of this topic

Create a new topic

Submit Reply

Previous Topic:	Catching outgoing spam / blocking account
Next Topic:	New webmail

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

PDF

]

Current Time: Fri Mar 24 21:00:41 CET 2023

Total time taken to generate the page: 0.01921 seconds