SonicOS Format String

2009-05-27T00:00:00
ID PACKETSTORM:77859
Type packetstorm
Reporter lofi42
Modified 2009-05-27T00:00:00

Description

                                        
                                            `SEC Consult Security Advisory < 20090525-4 >  
==========================================================================  
title: SonicOS Format String Vulnerability  
program: SonicWALL Global VPN Client  
vulnerable version: PRO 4100 SonicOS 4.0.0.2-51e Standard and Enhanced  
possibly other versions  
homepage: http://www.sonicwall.com  
found: October 2006  
by: lofi42  
permanent link: https://www.sec-consult.com/advisories_e.html#a54  
==========================================================================  
  
Product description:  
--------------------  
  
SonicOS Enhanced (SonicOSe) is the latest version of SonicWALL's  
powerful SonicOS operating system, designed for the next generation of  
SonicWALL firewall/VPN appliances.  
  
  
Vulnerability overview:  
-----------------------  
  
A format string vulnerability exists in the logfile parsing function of  
SonicOS. An attacker could crash the system or execute arbitrary code by  
injecting format string metacharacters into the logfile, if an  
administrator subsequently uses the SonicOS GUI to view the log.  
  
  
Proof of concept:  
-----------------  
  
There are multiple ways to inject format string characters into the  
logs. The following methods can be used to test for the vulnerability:  
  
1. CFS: Add ebay.com to your "Forbidden Domains" and access  
http://www.ebay.com/%s%s%s%s%s%s/.   
  
2. GroupVPN: Establish an GroupVPN Tunnel and enter at the XAUTH  
Username %s%s%s%s%s.   
  
3. Webfrontend: Enter at the Login Page of your SonicWALL as Username %s  
%s%s%s%s.   
  
  
SEC Consult will not release code execution exploits for this  
vulnerability to the public.  
  
  
  
Vendor contact timeline:  
------------------------  
  
2006: Vulnerability found  
2006.10.25: Vulnerability first reported to vendor  
2009.02.17: Vulnerability reported to vendor again  
2009.03.16: Request for status update  
2009.04.21: Request for status update  
2009.05.25: Public Release  
  
  
Patch:  
------  
  
SEC Consult was not able to get any vendor feedback on this issue. We  
are currently not aware of a patch or workaround.  
  
  
--  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
SEC Consult Unternehmensberatung GmbH  
  
Office Vienna  
Mooslackengasse 17  
A-1190 Vienna  
Austria  
  
Tel.: +43 / 1 / 890 30 43 - 0  
Fax.: +43 / 1 / 890 30 43 - 25  
Mail: research at sec-consult dot com  
www.sec-consult.com  
  
EOF SEC Consult Vulnerability Lab / @2009  
`