DATABASE RESOURCES PRICING ABOUT US

{"id": "SECURITYVULNS:DOC:21893", "bulletinFamily": "software", "title": "SEC Consult SA-20090525-4 :: SonicOS Format String Vulnerability", "description": "SEC Consult Security Advisory < 20090525-4 >\r\n==========================================================================\r\n title: SonicOS Format String Vulnerability\r\n program: SonicWALL Global VPN Client\r\n vulnerable version: PRO 4100 SonicOS 4.0.0.2-51e Standard and Enhanced\r\n possibly other versions\r\n homepage: http://www.sonicwall.com\r\n found: October 2006\r\n by: lofi42\r\n permanent link: https://www.sec-consult.com/advisories_e.html#a54\r\n==========================================================================\r\n\r\nProduct description:\r\n--------------------\r\n\r\nSonicOS Enhanced (SonicOSe) is the latest version of SonicWALL's\r\npowerful SonicOS operating system, designed for the next generation of\r\nSonicWALL firewall/VPN appliances.\r\n\r\n\r\nVulnerability overview:\r\n-----------------------\r\n\r\nA format string vulnerability exists in the logfile parsing function of\r\nSonicOS. An attacker could crash the system or execute arbitrary code by\r\ninjecting format string metacharacters into the logfile, if an\r\nadministrator subsequently uses the SonicOS GUI to view the log.\r\n\r\n\r\nProof of concept:\r\n-----------------\r\n\r\nThere are multiple ways to inject format string characters into the\r\nlogs. The following methods can be used to test for the vulnerability:\r\n\r\n1. CFS: Add ebay.com to your "Forbidden Domains" and access\r\nhttp://www.ebay.com/%s%s%s%s%s%s/. \r\n\r\n2. GroupVPN: Establish an GroupVPN Tunnel and enter at the XAUTH\r\nUsername %s%s%s%s%s. \r\n\r\n3. Webfrontend: Enter at the Login Page of your SonicWALL as Username %s\r\n%s%s%s%s. \r\n\r\n\r\nSEC Consult will not release code execution exploits for this\r\nvulnerability to the public.\r\n\r\n\r\n\r\nVendor contact timeline:\r\n------------------------\r\n\r\n2006: Vulnerability found\r\n2006.10.25: Vulnerability first reported to vendor\r\n2009.02.17: Vulnerability reported to vendor again\r\n2009.03.16: Request for status update\r\n2009.04.21: Request for status update\r\n2009.05.25: Public Release\r\n\r\n\r\nPatch:\r\n------\r\n\r\nSEC Consult was not able to get any vendor feedback on this issue. We\r\nare currently not aware of a patch or workaround.\r\n\r\n\r\n--\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nSEC Consult Unternehmensberatung GmbH\r\n\r\nOffice Vienna\r\nMooslackengasse 17\r\nA-1190 Vienna\r\nAustria\r\n\r\nTel.: +43 / 1 / 890 30 43 - 0\r\nFax.: +43 / 1 / 890 30 43 - 25\r\nMail: research at sec-consult dot com\r\nwww.sec-consult.com\r\n\r\nEOF SEC Consult Vulnerability Lab / @2009", "published": "2009-05-27T00:00:00", "modified": "2009-05-27T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:21893", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:30", "edition": 1, "viewCount": 23, "enchantments": {"score": {"value": 1.3, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:9942"]}], "rev": 4}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:9942"]}]}, "exploitation": null, "vulnersScore": 1.3}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645658252}}

{}