| Main Archive Page > Month Archives > full-disclosure-uk archives |
[Full-disclosure] SEC Consult SA-20090525-4 :: SonicOS Format String Vulnerability
From: Bernhard Mueller <research_at_nospam>Date: Tue May 26 2009 - 14:48:10 GMT
To: Full Disclosure <full-disclosure@lists.grok.org.uk>, Bugtraq <bugtraq@securityfocus.com>
SEC Consult Security Advisory < 20090525-4 >
title: SonicOS Format String Vulnerability program: SonicWALL Global VPN Client vulnerable version: PRO 4100 SonicOS 4.0.0.2-51e Standard and Enhanced possibly other versions homepage: http://www.sonicwall.com found: October 2006 by: lofi42 permanent link: https://www.sec-consult.com/advisories_e.html#a54
==========================================================================
Product description:
SonicOS Enhanced (SonicOSe) is the latest version of SonicWALL's powerful SonicOS operating system, designed for the next generation of SonicWALL firewall/VPN appliances.
Vulnerability overview:
A format string vulnerability exists in the logfile parsing function of SonicOS. An attacker could crash the system or execute arbitrary code by injecting format string metacharacters into the logfile, if an administrator subsequently uses the SonicOS GUI to view the log.
Proof of concept:
There are multiple ways to inject format string characters into the logs. The following methods can be used to test for the vulnerability:
- CFS: Add ebay.com to your "Forbidden Domains" and access http://www.ebay.com/%s%s%s%s%s%s/.
- GroupVPN: Establish an GroupVPN Tunnel and enter at the XAUTH Username %s%s%s%s%s.
- Webfrontend: Enter at the Login Page of your SonicWALL as Username %s %s%s%s%s.
SEC Consult will not release code execution exploits for this vulnerability to the public.
Vendor contact timeline:
2006: Vulnerability found 2006.10.25: Vulnerability first reported to vendor 2009.02.17: Vulnerability reported to vendor again 2009.03.16: Request for status update 2009.04.21: Request for status update 2009.05.25: Public Release
Patch:
SEC Consult was not able to get any vendor feedback on this issue. We are currently not aware of a patch or workaround. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Unternehmensberatung GmbH Office Vienna Mooslackengasse 17 A-1190 Vienna Austria Tel.: +43 / 1 / 890 30 43 - 0 Fax.: +43 / 1 / 890 30 43 - 25 Mail: research at sec-consult dot com www.sec-consult.com EOF SEC Consult Vulnerability Lab / @2009 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/