SonicWALL Global VPN Client 4.0 Log File Remote Format String Vulnerability

ID SSV:86267
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application. Failed attempts may cause denial-of-service conditions.

Global VPN Client Standard and Enhanced are vulnerable; other versions may also be affected. 

The following proofs of concept are available:

1. CFS: Add to your "Forbidden Domains" and access

2. GroupVPN: Establish a GroupVPN Tunnel and enter at the XAUTH Username %s%s%s%s%s.

3. Webfrontend: Enter at the Login Page of your SonicWALL as Username %s%s%s%s%s