SonicWALL E-Class SSL-VPN ActiveX Control DoS PoC

-------------------------- NSOADV-2010-005 --------------------------- SonicWALL E-Class SSL-VPN ActiveX Control format string overflow ______________________________________________________________________ ______________________________________________________________________ 111101111 11111 00110 00110001111 111111 01 01 1 11111011111111 11111 0 11 01 0 11 1 1 111011001 11111111101 1 11 0110111 1 1111101111 1001 0 1 10 11 0 10 11 1111111 1 111 111001 111111111 0 10 1111 0 11 11 111111111 1 1101 10 00111 0 0 11 00 0 1110 1 1011111111111 1111111 11 100 10111111 0 01 0 1 1 111110 11 1111111111111 11110000011 0111111110 0110 1110 1 0 11101111111111111011 11100 00 01111 0 10 1110 1 011111 1 111111111111111111111101 01 01110 0 10 111110 110 0 11101111111111111111101111101 111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111 111110110 10 0111110 1 0 0 1111111111111111111111111 110 111 11111 1 1 111 1 10011 101111111111011111111 0 1100 111 10 110 101011110010 11111111111111111111111 11 0011100 11 10 001100 0001 111111111111111111 10 11 11110 11110 00100 00001 10 1 1111 101010001 11111111 11101 0 1011 10000 00100 11100 00001101 0 0110 111011011 0110 10001 101 11110 1011 1 10 101 000001 01 00 1010 1 11001 1 1 101 10 110101011 0 101 11110 110000011 111 ______________________________________________________________________ ______________________________________________________________________ Title: SonicWALL E-Class SSL-VPN ActiveX Control format string overflow Severity: High Advisory ID: NSOADV-2010-005 Found Date: 22.02.2010 Date Reported: 09.06.2010 Release Date: 19.08.2010 Author: Nikolas Sotiriu Website: http://sotiriu.de Twitter: http://twitter.com/nsoresearch Mail: nso-research at sotiriu.de URL: http://sotiriu.de/adv/NSOADV-2009-005.txt Vendor: SonicWALL (http://www.sonicwall.com/) Affected Products: SonicWALL SRA EX1600 SonicWALL EX7000 SonicWALL EX6000 SonicWALL EX-1600 SonicWALL EX-1500 SonicWALL EX-750 Affected Versions: 10.0.4 and all previous versions 10.5.1 without hotfix Remote Exploitable: Yes Local Exploitable: No Patch Status: Vendor released a patch Discovered by: Nikolas Sotiriu Disclosure Policy: http://sotiriu.de/policy.html Thanks to: Thierry Zoller: For the permission to use his Policy Background: =========== SonicWALL has added the award-winning Aventail SSL VPN product line to our E-Class SRA appliances. Aventail's best-of-breed SSL VPNs deliver secure remote access to the most resources from the most end point locations. Aventail was named in the Visionaries Quadrant in the SSL VPN Magic Quadrant Report from Gartner, considered to be the leading analyst firm covering the SSL VPN industry. (Product description from Website) Description: ============ Remote exploitation of a format string overflow vulnerability in the End-Point Interrogator/Installer ActiveX Control could allow an attacker to execute arbitrary code within the security context of the targeted user. The affected function is "AuthCredential". The functions "ConfigurationString" seems to be also vulnerable, but the format string has to be base64 decoded. Name: End-Point Interrogator/Installer Module Vendor: Aventail Corporation Type: ActiveX-Control Version: 10.3.42 Prog ID: EPILib.EPInterrogator GUID: {2A1BE1E7-C550-4D67-A553-7F2D3A39233D} File: epi.dll Folder: %userprofile%\Application Data\Aventail\epi Safe for Script: True Safe for Init: True Proof of Concept : ================== SonicWALL E-Class SSL-VPN ActiveX Control DoS PoC

Notes: ====== The Exploit overwrites the EAX register with 0x61616161. EAX 61616161 ECX 000007F2 EDX 00000000 EBX FFFF006E ESP 01929AE4 EBP 01929F54 ESI 00000020 EDI 00000002 EIP 77C1391B msvcrt.77C1391B C 0 ES 0023 32bit 0(FFFFFFFF) P 1 CS 001B 32bit 0(FFFFFFFF) A 0 SS 0023 32bit 0(FFFFFFFF) Z 1 DS 0023 32bit 0(FFFFFFFF) S 0 FS 003B 32bit 7FFD8000(FFF) T 0 GS 0000 NULL D 0 O 0 LastErr ERROR_SUCCESS (00000000) EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE) ST0 empty +UNORM 1C68 00000000 E162AA10 ST1 empty 7.5918347351318302720e-1715 ST2 empty +UNORM 001C 7779065D E19F4F1C ST3 empty 3.4653990691284428800e+1178 ST4 empty 0.0000000000840901890e-4933 ST5 empty -??? FFFF 00000000 00000000 ST6 empty 6.4564231821671188480e-4932 ST7 empty 1.0000000000000000000 3 2 1 0 E S P U O Z D I FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT) FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1 The function where the exception occurs looks like this: 77C1391B 8908 MOV DWORD PTR DS:[EAX],ECX Solution: ========= Version 10.0.5: +-------------- Download the new version on www.mysonicwall.com Version 10.5.1: +-------------- SonicWALL Security Advisory: http://www.sonicwall.com/us/support/kb.asp?kbid=8272 Disclosure Timeline (YYYY/MM/DD): ================================= 2010.02.22: Vulnerability found 2010.06.08: Ask on full-disc for a SonicWALL security contact 2010.06.09: Initial contact by info () sonicwall and germany () sonicwall email address 2010.06.09: Initial Vendor response by phone from a german SonicWALL SE 2010.06.09: Got an email from SonicWALL as a response to my mail to full-disc with the contact email address security () sonicwall com 2010.06.10: Sent the Notification and Disclosure Policy and ask for a PGP Key [-] No Response 2010.06.18: Got an email response from the SonicWALL SSL-VPN Product Manager with a PGP key. 2010.06.19: Sent PoC, Advisory, Disclosure policy and planned disclosure date (2010.06.24) to Vendor 2010.06.19: SonicWALL acknowledges the reception of the advisory 2010.06.22: Vendor verifies the vulnerability 2010.07.07: Ask for a status update, because the planned release date was the 2010.06.24 2010.07.07: SonicWALL informs me that they will release a new version at end of July. 2010.07.07: Changed release date to 2010.07.29 2010.07.29: Ask for a status update, because the planned release date is the 2010.07.29 2010.07.29: SonicWALL informs me that the version 10.0.5 is in final QA and should be released next week. 2010.08.13: Send SonicWALL the information, that i will release the advisory at Wednesday 2010.08.18. 2010.08.16: SonicWALL informs me that the version 10.0.5 is already downloadable for customers. 2010.08.16: Ask for an SonicWALL advisory and a list of affected products 2010.08.17: SonicWALL sends me there advisory draft 2010.08.18: Ask SonicWALL for credits in there advisory 2010.08.19: Release of this advisory

Query Builder