SonicWALL E-Class SSL-VPN Format String Vulnerability

Bugtraq ID:	42548
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 19 2010 12:00AM
Updated:	Aug 19 2010 12:00AM
Credit:	Nikolas Sotiriu
Vulnerable:
Not Vulnerable:

SonicWALL E-Class SSL-VPN Format String Vulnerability

SonicWALL E-Class SSL VPN contains a format-string vulnerability that occurs because the application fails to properly sanitize user-supplied data to an ActiveX control.

An attacker may exploit this vulnerability to cause arbitrary code to run within the context of the application, typically SonicWall, that uses the ActiveX control. Failed exploit attempts will result in a denial-of-service conditions.

This issue affects SonicWALL E-Class SSL-VPN 10.0.4 and all previous versions as well as 10.5.1 without hotfix; other versions may also be vulnerable.

SonicWALL E-Class SSL-VPN Format String Vulnerability

An attacker may exploit this issue by enticing a victim into visiting a malicious webpage.

The following proof of concept is available:

• /data/vulnerabilities/exploits/42548.html

SonicWALL E-Class SSL-VPN Format String Vulnerability

Solution:
Reportedly, the vendor has released SonicWALL E-Class SSL-VPN 10.0.5 and a patch for SonicWALL E-Class SSL-VPN 10.5.1 to address this issue but Symantec has not confirmed this. Please contact the vendor for more information.

SonicWALL E-Class SSL-VPN Format String Vulnerability

References:

• NSOADV-2010-005: SonicWALL E-Class SSL-VPN ActiveX Control format string overflo (sotiriu)
  
• SonicWALL Security Advisory (SonicWALL)
  
• Vendor Homepage (SonicWALL)