Multiple SonicWALL Products CVE-2013-1360 Authentication Bypass Vulnerability

Bugtraq ID:	57446
Class:	Design Error
CVE:	CVE-2013-1360
Remote:	Yes
Local:	No
Published:	Jan 17 2013 12:00AM
Updated:	Jan 17 2013 12:00AM
Credit:	Nikolas Sotiriu
Vulnerable:
Not Vulnerable:

Multiple SonicWALL Products CVE-2013-1360 Authentication Bypass Vulnerability

Multiple SonicWALL products including Global Management System (GMS), ViewPoint, Universal Management Appliance (UMA), and Analyzer are prone to an authentication-bypass vulnerability.

Attackers can exploit this issue to gain administrative access to the web interface that could fully compromise the system.

The following versions are affected:

GMS/Analyzer/UMA 7.0.x
GMS/ViewPoint/UMA 6.0.x
GMS/ViewPoint/UMA 5.1.x
GMS/ViewPoint 5.0.x
GMS/ViewPoint 4.1.x

Multiple SonicWALL Products CVE-2013-1360 Authentication Bypass Vulnerability

Attackers can exploit this issue through a browser.

The following example URI is available:

http://www.example.com/sgms/auth?clientHash=765c5e5b571050030b63666663383064663 83761376339303932346163656262&clientHash2=03196ba18cffc80df87a7c9092 4acebb&changePassword=1&user=admin&ctlSGMSDomainId=DMN00000000000000 00000000001

Multiple SonicWALL Products CVE-2013-1360 Authentication Bypass Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Multiple SonicWALL Products CVE-2013-1360 Authentication Bypass Vulnerability

References: