Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:21893
HistoryMay 27, 2009 - 12:00 a.m.

SEC Consult SA-20090525-4 :: SonicOS Format String Vulnerability

2009-05-2700:00:00
vulners.com
37

SEC Consult Security Advisory < 20090525-4 >

          title: SonicOS Format String Vulnerability
        program: SonicWALL Global VPN Client

vulnerable version: PRO 4100 SonicOS 4.0.0.2-51e Standard and Enhanced
possibly other versions
homepage: http://www.sonicwall.com
found: October 2006
by: lofi42
permanent link: https://www.sec-consult.com/advisories_e.html#a54

Product description:

SonicOS Enhanced (SonicOSe) is the latest version of SonicWALL's
powerful SonicOS operating system, designed for the next generation of
SonicWALL firewall/VPN appliances.

Vulnerability overview:

A format string vulnerability exists in the logfile parsing function of
SonicOS. An attacker could crash the system or execute arbitrary code by
injecting format string metacharacters into the logfile, if an
administrator subsequently uses the SonicOS GUI to view the log.

Proof of concept:

There are multiple ways to inject format string characters into the
logs. The following methods can be used to test for the vulnerability:

  1. CFS: Add ebay.com to your "Forbidden Domains" and access
    http://www.ebay.com/&#37;s&#37;s&#37;s&#37;s&#37;s&#37;s/.

  2. GroupVPN: Establish an GroupVPN Tunnel and enter at the XAUTH
    Username %s%s%s%s%s.

  3. Webfrontend: Enter at the Login Page of your SonicWALL as Username %s
    %s%s%s%s.

SEC Consult will not release code execution exploits for this
vulnerability to the public.

Vendor contact timeline:

2006: Vulnerability found
2006.10.25: Vulnerability first reported to vendor
2009.02.17: Vulnerability reported to vendor again
2009.03.16: Request for status update
2009.04.21: Request for status update
2009.05.25: Public Release

Patch:

SEC Consult was not able to get any vendor feedback on this issue. We
are currently not aware of a patch or workaround.

SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna
Austria

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
www.sec-consult.com

EOF SEC Consult Vulnerability Lab / @2009