SonicWALL SSL-VPN Client Buffer Overflows in WebCacheCleaner/NeLaunchCtrl ActiveX Controls Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1018891
|
|
SecurityTracker URL: http://securitytracker.com/id?1018891
|
|
CVE Reference: CVE-2007-5603
(Links to External Site)
|
Date: Nov 2 2007
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Description: A vulnerability was reported in the SonicWALL SSL-VPN Client software and NetExtender devices. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a buffer overflow in the WebCacheCleaner
ActiveX control or the NeLaunchCtrl ActiveX control and execute arbitrary code on the target system. The code will run with the
privileges of the target user.
The CLSIDs of the vulnerable controls are: 6EEFD7B1-B26C-440D-B55A-1EC677189F30 and 79D6214F-CFCE-480F-9901-27950E78F1E6
The
NetExtender devices and SSL-VPN client software are affected.
The vendor was notified on May 21, 2007.
Will Dormann of CERT/CC
reported one of these vulnerabilities. lofi42 independently reported both vulnerabilities via SEC Consult.
The original advisories
are available at:
http://www.kb.cert.org/vuls/id/298521
http://www.sec-consult.com/fileadmin/Advisories/20071101-0_sonicwall_multiple.txt
|
Impact: A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution: The vendor has issued fixed versions (version 2.1 of SSL-VPN 200; version 2.5 of SSL-VPN 2000/4000).
The vendor has not provided a publicly available advisory.
|
Vendor URL: www.sonicwall.com/ (Links to External Site)
|
Cause: Boundary error
|
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 2 Nov 2007 07:37:03 -0500
Subject: SonicWall NetExtender NELaunchCtrl ActiveX control stack buffer overflow
|
http://www.kb.cert.org/vuls/id/298521
CVE-2007-5603
|
|
