SonicWALL Global VPN Client Log File Remote Format String Vulnerability

Bugtraq ID:	35093
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 26 2009 12:00AM
Updated:	May 26 2009 05:10PM
Credit:	lofi42 from SEC Consult
Vulnerable:	SonicWALL Global VPN Client 4.0 .2-51e Standard SonicWALL Global VPN Client 4.0 .2-51e Enhanced
Not Vulnerable:

SonicWALL Global VPN Client Log File Remote Format String Vulnerability

SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application. Failed attempts may cause denial-of-service conditions.

Global VPN Client 4.0.0.2-51e Standard and Enhanced are vulnerable; other versions may also be affected.

SonicWALL Global VPN Client Log File Remote Format String Vulnerability

The following proofs of concept are available:

1. CFS: Add example.com to your "Forbidden Domains" and access http://www.example.com/%s%s%s%s%s%s/.

2. GroupVPN: Establish a GroupVPN Tunnel and enter at the XAUTH Username %s%s%s%s%s.

3. Webfrontend: Enter at the Login Page of your SonicWALL as Username %s%s%s%s%s

SonicWALL Global VPN Client Log File Remote Format String Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SonicWALL Global VPN Client Log File Remote Format String Vulnerability

References:

• SonicWALL Global VPN Client Homepage (SonicWALL)
  
• SEC Consult SA-20090525-4 :: SonicOS Format String Vulnerability (Bernhard Mueller )
  
• SEC Consult Security Advisory < 20090525-4 > (SEC Consult)