SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Encryption/VPN)  >   Dell SonicWALL Vendors:   SonicWALL
SonicWALL SSL-VPN Client Buffer Overflows in WebCacheCleaner/NeLaunchCtrl ActiveX Controls Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1018891
SecurityTracker URL:  http://securitytracker.com/id/1018891
CVE Reference:   CVE-2007-5603   (Links to External Site)
Date:  Nov 2 2007
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in the SonicWALL SSL-VPN Client software and NetExtender devices. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a buffer overflow in the WebCacheCleaner ActiveX control or the NeLaunchCtrl ActiveX control and execute arbitrary code on the target system. The code will run with the privileges of the target user.

The CLSIDs of the vulnerable controls are: 6EEFD7B1-B26C-440D-B55A-1EC677189F30 and 79D6214F-CFCE-480F-9901-27950E78F1E6

The NetExtender devices and SSL-VPN client software are affected.

The vendor was notified on May 21, 2007.

Will Dormann of CERT/CC reported one of these vulnerabilities. lofi42 independently reported both vulnerabilities via SEC Consult.

The original advisories are available at:

http://www.kb.cert.org/vuls/id/298521
http://www.sec-consult.com/fileadmin/Advisories/20071101-0_sonicwall_multiple.txt

Impact:   A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued fixed versions (version 2.1 of SSL-VPN 200; version 2.5 of SSL-VPN 2000/4000).

The vendor has not provided a publicly available advisory.

Vendor URL:  www.sonicwall.com/ (Links to External Site)
Cause:   Boundary error

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC