Multiple SonicWALL Products CVE-2013-1359 Authentication Bypass Vulnerability

Bugtraq ID:	57445
Class:	Design Error
CVE:	CVE-2013-1359
Remote:	Yes
Local:	No
Published:	Jan 17 2013 12:00AM
Updated:	Jan 24 2013 07:00PM
Credit:	Nikolas Sotiriu
Vulnerable:
Not Vulnerable:

Multiple SonicWALL Products CVE-2013-1359 Authentication Bypass Vulnerability

Multiple SonicWALL products including Global Management System (GMS), ViewPoint, Universal Management Appliance (UMA), and Analyzer are prone to an authentication-bypass vulnerability.

Attackers can exploit this issue to gain administrative access to the web interface. This allows attackers to execute arbitrary code with SYSTEM privileges that could fully compromise the system.

The following versions are affected:

GMS/Analyzer/UMA 7.0.x
GMS/ViewPoint/UMA 6.0.x
GMS/ViewPoint/UMA 5.1.x
GMS/ViewPoint 5.0.x
GMS/ViewPoint 4.1.x

Multiple SonicWALL Products CVE-2013-1359 Authentication Bypass Vulnerability

Attackers can exploit this issue through a browser.

The following example URI is available:

http://www.example.com/appliance/applianceMainPage?action=status&skipSessionCheck=1

The following exploits are available:

• /data/vulnerabilities/exploits/57445.pl
• /data/vulnerabilities/exploits/57445.rb

Multiple SonicWALL Products CVE-2013-1359 Authentication Bypass Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Multiple SonicWALL Products CVE-2013-1359 Authentication Bypass Vulnerability

References: