Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Network Appliances :: 1008-103.htm

SonicWALL E-Class SSL-VPN ActiveX Control format string overflow



NSOADV-2010-005: SonicWALL E-Class SSL-VPN ActiveX Control format string overflow
NSOADV-2010-005: SonicWALL E-Class SSL-VPN ActiveX Control format string overflow



______________________________________________________________________

-------------------------- NSOADV-2010-005 ---------------------------

   SonicWALL E-Class SSL-VPN ActiveX Control format string overflow
______________________________________________________________________
______________________________________________________________________

                               111101111
                        11111 00110 00110001111
                   111111 01 01 1 11111011111111
                11111  0 11 01 0 11 1 1  111011001
             11111111101 1 11 0110111  1    1111101111
           1001  0 1 10 11 0 10 11 1111111  1 111 111001
         111111111 0 10 1111 0 11 11 111111111 1 1101 10
        00111 0 0 11 00 0 1110 1 1011111111111 1111111 11  100
       10111111 0 01 0  1 1 111110 11 1111111111111  11110000011
       0111111110 0110 1110 1 0 11101111111111111011 11100  00
       01111 0 10 1110 1 011111 1 111111111111111111111101 01
       01110 0 10 111110 110 0 11101111111111111111101111101
      111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111
      111110110 10 0111110 1 0 0 1111111111111111111111111 110
    111 11111 1  1 111 1   10011 101111111111011111111 0   1100
   111 10  110 101011110010   11111111111111111111111 11 0011100
   11 10     001100     0001      111111111111111111 10 11 11110
  11110       00100      00001     10 1  1111  101010001 11111111
  11101        0  1011     10000    00100 11100        00001101 0
  0110         111011011             0110   10001        101 11110
  1011                 1             10 101   000001        01   00
   1010 1                              11001      1 1        101  10
      110101011                          0 101                 11110
            110000011
                      111
______________________________________________________________________
______________________________________________________________________

  Title:                  SonicWALL E-Class SSL-VPN ActiveX Control
                          format string overflow
  Severity:               High
  Advisory ID:            NSOADV-2010-005
  Found Date:             22.02.2010
  Date Reported:          09.06.2010
  Release Date:           19.08.2010
  Author:                 Nikolas Sotiriu
Website: http://sotiriu.de 
Twitter: http://twitter.com/nsoresearch 
  Mail:                   nso-research at sotiriu.de
URL: http://sotiriu.de/adv/NSOADV-2009-005.txt 
Vendor: SonicWALL (http://www.sonicwall.com/) 
  Affected Products:      SonicWALL SRA EX1600
                          SonicWALL EX7000
                          SonicWALL EX6000
                          SonicWALL EX-1600
                          SonicWALL EX-1500
                          SonicWALL EX-750
  Affected Versions:      10.0.4 and all previous versions
                          10.5.1 without hotfix
  Remote Exploitable:     Yes
  Local Exploitable:      No
  Patch Status:           Vendor released a patch
  Discovered by:          Nikolas Sotiriu
Disclosure Policy: http://sotiriu.de/policy.html 
  Thanks to:              Thierry Zoller: For the permission to use his
                                          Policy



Background:
==========
SonicWALL has added the award-winning Aventail SSL VPN  product line to
our E-Class SRA appliances. Aventail's best-of-breed SSL VPNs deliver
secure remote access to the most resources from the most end point
locations. Aventail was named in the Visionaries Quadrant in the SSL
VPN Magic Quadrant Report from Gartner, considered to be the leading
analyst firm covering the SSL VPN industry.

(Product description from Website)



Description:
===========
Remote exploitation of a format string overflow vulnerability in the
End-Point Interrogator/Installer ActiveX Control could allow an attacker
to execute arbitrary code within the security context of the targeted
user.

The affected function is "AuthCredential". The functions
"ConfigurationString" seems to be also vulnerable, but the format
string has to be base64 decoded.

Name:             End-Point Interrogator/Installer Module
Vendor:           Aventail Corporation
Type:             ActiveX-Control
Version:          10.3.42
Prog ID:          EPILib.EPInterrogator
GUID:             {2A1BE1E7-C550-4D67-A553-7F2D3A39233D}
File:             epi.dll
Folder:           %userprofile%\Application Data\Aventail\epi
Safe for Script:  True
Safe for Init: 	  True



Proof of Concept :
=================

 
  SonicWALL E-Class SSL-VPN ActiveX Control DoS PoC
 

src="http://sotiriu.de/images/logo_wh_80.png"> 




Notes: ===== The Exploit overwrites the EAX register with 0x61616161. EAX 61616161 ECX 000007F2 EDX 00000000 EBX FFFF006E ESP 01929AE4 EBP 01929F54 ESI 00000020 EDI 00000002 EIP 77C1391B msvcrt.77C1391B C 0 ES 0023 32bit 0(FFFFFFFF) P 1 CS 001B 32bit 0(FFFFFFFF) A 0 SS 0023 32bit 0(FFFFFFFF) Z 1 DS 0023 32bit 0(FFFFFFFF) S 0 FS 003B 32bit 7FFD8000(FFF) T 0 GS 0000 NULL D 0 O 0 LastErr ERROR_SUCCESS (00000000) EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE) ST0 empty +UNORM 1C68 00000000 E162AA10 ST1 empty 7.5918347351318302720e-1715 ST2 empty +UNORM 001C 7779065D E19F4F1C ST3 empty 3.4653990691284428800e+1178 ST4 empty 0.0000000000840901890e-4933 ST5 empty -??? FFFF 00000000 00000000 ST6 empty 6.4564231821671188480e-4932 ST7 empty 1.0000000000000000000 3 2 1 0 E S P U O Z D I FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT) FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1 The function where the exception occurs looks like this: 77C1391B 8908 MOV DWORD PTR DS:[EAX],ECX Solution: ======== Version 10.0.5: +-------------- Download the new version on www.mysonicwall.com Version 10.5.1: +-------------- SonicWALL Security Advisory: http://www.sonicwall.com/us/support/kb.asp?kbid=8272 Disclosure Timeline (YYYY/MM/DD): ================================ 2010.02.22: Vulnerability found 2010.06.08: Ask on full-disc for a SonicWALL security contact 2010.06.09: Initial contact by info@sonicwall and germany@sonicwall email address 2010.06.09: Initial Vendor response by phone from a german SonicWALL SE 2010.06.09: Got an email from SonicWALL as a response to my mail to full-disc with the contact email address security@sonicwall.com 2010.06.10: Sent the Notification and Disclosure Policy and ask for a PGP Key [-] No Response 2010.06.18: Got an email response from the SonicWALL SSL-VPN Product Manager with a PGP key. 2010.06.19: Sent PoC, Advisory, Disclosure policy and planned disclosure date (2010.06.24) to Vendor 2010.06.19: SonicWALL acknowledges the reception of the advisory 2010.06.22: Vendor verifies the vulnerability 2010.07.07: Ask for a status update, because the planned release date was the 2010.06.24 2010.07.07: SonicWALL informs me that they will release a new version at end of July. 2010.07.07: Changed release date to 2010.07.29 2010.07.29: Ask for a status update, because the planned release date is the 2010.07.29 2010.07.29: SonicWALL informs me that the version 10.0.5 is in final QA and should be released next week. 2010.08.13: Send SonicWALL the information, that i will release the advisory at Wednesday 2010.08.18. 2010.08.16: SonicWALL informs me that the version 10.0.5 is already downloadable for customers. 2010.08.16: Ask for an SonicWALL advisory and a list of affected products 2010.08.17: SonicWALL sends me there advisory draft 2010.08.18: Ask SonicWALL for credits in there advisory 2010.08.19: Release of this advisory


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH