F5 FirePass 4100 crossite scripting

SSL VPN downloadplugin.php3, page backurl parameter, my.logon.php3, my.activation.php3 crossite scripting...

New attack class exploits intranet weaknesses

A security researcher has developed an interesting new class of attacks that exploit the problems caused by organizations using non-routable IP space on their internal networks, including one attack that compromises VPN users through the use of a persistent JavaScript backdoor. The attacks rely o...

SonicWALL SSL-VPN登录页面远程格式串漏洞

BUGTRAQ ID: 35145 SonicWALL SSL-VPN可以为企业网络提供简单易用的VPN解决方案。 SonicWALL SSL-VPN的登录页面中存在格式串错误。如果远程攻击者向登录页面的cgi-bin/welcome/VirtualOffice组件提交了带有err参数格式串标识符的特制字符串，就可能在生成的出错消息中注入并执行任意代码。 SonicWALL SSL-VPN 2000/4000 3.5.0.4 SonicWALL SSL-VPN 200 3.0.0.8 厂商补丁： SonicWALL ---------...

SafeNet SoftRemote IKE服务远程栈溢出漏洞

BUGTRAQ ID: 35154 SoftRemote是SafeNET VPN产品系列中的VPN客户端。 Softremote中默认监听于UDP 62514端口上的VPN服务（ireIke.exe）存在栈溢出漏洞。如果远程攻击者向该服务提交了超长请求的话，就可以触发这个溢出，导致以SYSTEM权限执行任意代码。 SafeNet SoftRemote 10.8.6 厂商补丁： SafeNet ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.safenet-inc.com/products/vpn/softRemote.asp...

strongSwan IKE请求多个拒绝服务漏洞

BUGTRAQ ID: 35178 strongSwan是Linux平台所使用的基于IPsec的开源VPN解决方案。 如果远程攻击者发送了特制的IKESAINIT和CREATECHILDSA请求，或发送了缺少TSi或TSr负载的IKEAUTH请求，就会在strongSwan的IKEv2 charon守护程序中触发空指针引用，导致拒绝服务。 strongSwan 4.1.0 - 4.3.0 厂商补丁： strongSwan ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Encrypted tunnels enable users to circumvent security controls

In the previous article, I talked a bit about how employees are using external proxies to hide web activity from the prying eyes of the IT department. This article discusses the use of encrypted tunnel applications to hide from detection. To someone like myself an admitted web 1.2 kinda guy, usin...

SonicWALL SSL-VPN Appliance Format String Vulnerability

aushack.com - Vulnerability Advisory ----------------------------------------------- Release Date: 29-May-2009 Software: SonicWALL - SSL-VPN Remote Access http://www.sonicwall.com/ Description: "SonicWALL SSL VPN appliances provide small and mid-size organizations an easy-to-use, secure and...

SonicWALL Format String Vulnerability

aushack.com - Vulnerability Advisory ----------------------------------------------- Release Date: 29-May-2009 Software: SonicWALL - SSL-VPN Remote Access http://www.sonicwall.com/ Description: "SonicWALL SSL VPN appliances provide small and mid-size organizations an easy-to-use, secure and...

SonicWALL SSL-VPN - 'cgi-bin/welcome/VirtualOffice' Remote Format String

source: https://www.securityfocus.com/bid/35145/info Multiple SonicWALL SSL-VPN devices are prone to a remote format-string vulnerability because they fail to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function. Attackers may exploit th...

SonicWALL SSL-VPN - cgi-binwelcomeVirtualOffice Remote Format String

SonicWALL SSL-VPN - cgi-binwelcomeVirtualOffice Remote Format String source: https://www.securityfocus.com/bid/35145/info Multiple SonicWALL SSL-VPN devices are prone to a remote format-string vulnerability because they fail to properly sanitize user-supplied input before passing it as the format...

SonicWALL Global VPN客户端日志文件远程格式串漏洞

Bugraq ID: 35093 CNCAN ID：CNCAN-2009052706 SonicOS Enhanced SonicOSe是SonicWALL sonicOS操作系统最新版本，设计用于下一代SonicWALL firewall/VPN应用设备。 SonicOS的日志文件解析函数存在格式串问题，远程攻击者可以利用漏洞通过注入格式串字符到日志文件使系统崩溃或执行任意代码。 可通过多种方法注入格式串字符到日志中，当管理员使用SonicOS GUI查看日志时可触发此漏洞。 如下方法可测试此漏洞： 1，CFS:增加ebay.com到"Forbidden...

BlackBerry附件服务PDF处理器多个未明安全漏洞

Bugraq ID: 35102 CNCAN ID：CNCAN-2009052702 BlackBerry企业服务器的BlackBerry附件服务组件处理恶意PDF文件时存在多个安全问题，远程攻击者可以利用漏洞以应用服务进程权限执行任意指令，或导致拒绝服务攻击。 攻击者可以通过发送包含特殊构建的PDF文件的EMAIL消息来触发，目前没有详细漏洞细节提供。 Symantec Clientless VPN Gateway 4400 Series 4.0 SP3 Symantec Clientless VPN Gateway 4400 Series 4.0 SP2 Symantec...

SonicWALL Global VPN客户端'RampartSvc'本地特权提升漏洞

Bugraq ID: 35092 CNCAN ID：CNCAN-2009052705 SonicWALL Global VPN Client是一款许移动用户建立到SonicWALL VPN网关安全连接的应用程序。 SonicWALL Global VPN Client安装时设置权限不正确，本地攻击者可以利用漏洞提升特权。 在SonicWALL Global VPN Client安装中，安装文件夹"%ProgramFiles%\SonicWALL\SonicWALL Global VPN...

SonicWALL Global VPN Client < 4.0.0.830 Format String Vulnerabilities

The version of the SonicWALL Global VPN Client software installed on the remote Windows host fails to sanitize the 'name' attribute of the 'Connection' tag and the content of the 'Hostname' tag in the configuration file of format strings. If an attacker can trick a user on the affected host into...

SEC Consult SA-20090525-4 :: SonicOS Format String Vulnerability

SEC Consult Security Advisory 20090525-4 ========================================================================== title: SonicOS Format String Vulnerability program: SonicWALL Global VPN Client vulnerable version: PRO 4100 SonicOS 4.0.0.2-51e Standard and Enhanced possibly other versions...

SonicWALL Global VPN Client Privilege Escalation

SEC Consult Security Advisory ========================================================================== title: SonicWALL Global VPN Client Local Privilege Escalation Vulnerability program: SonicWALL Global VPN Client vulnerable version: Global VPN Client = 4.0.0.835 possibly other versions...

SEC Consult SA-20090525-3 :: SonicWALL Global VPN Client Local Privilege Escalation Vulnerability

SEC Consult Security Advisory 20090525-3 ========================================================================== title: SonicWALL Global VPN Client Local Privilege Escalation Vulnerability program: SonicWALL Global VPN Client vulnerable version: Global VPN Client = 4.0.0.835 possibly other...

SonicOS Format String

SEC Consult Security Advisory ========================================================================== title: SonicOS Format String Vulnerability program: SonicWALL Global VPN Client vulnerable version: PRO 4100 SonicOS 4.0.0.2-51e Standard and Enhanced possibly other versions homepage:...

SonicWALL Global VPN Client weak file permissions

Everyone:Full Control permission on application folder...

SonicWALL Global VPN Client 4.0 - Log File Remote Format String

SonicWALL Global VPN Client 4.0 - Log File Remote Format String source: https://www.securityfocus.com/bid/35093/info SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to ...