SonicWALL Global VPN Client Format String Bug Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID: 1022281|
SecurityTracker URL: http://securitytracker.com/id/1022281
(Links to External Site)
Date: May 26 2009
Execution of arbitrary code via network, User access via network|
Exploit Included: Yes |
Version(s): SonicOS 220.127.116.11-51e; possibly other versions|
A vulnerability was reported in SonicWALL Global VPN Client. A remote user can execute arbitrary code on the target administrator's system.|
A remote user can inject specially crafted characters into the logfile. Then, when the target administrator views the logfile via the SonicOS GUI, a format string bug will be triggered, executing arbitrary code on the target administrator's system.
The vendor was notified on October 25, 2006.
The original advisory is available at:
lofi42 of SEC Consult reported this vulnerability.
A remote user can cause arbitrary code to be executed on the target administrator's system.|
No solution was available at the time of this entry.|
Vendor URL: www.sonicwall.com/ (Links to External Site)
Input validation error, State error|
Source Message Contents
Subject: SEC Consult SA-20090525-4 :: SonicOS Format String Vulnerability|
SEC Consult Security Advisory < 20090525-4 >
title: SonicOS Format String Vulnerability
program: SonicWALL Global VPN Client
vulnerable version: PRO 4100 SonicOS 18.104.22.168-51e Standard and Enhanced
possibly other versions
found: October 2006
permanent link: https://www.sec-consult.com/advisories_e.html#a54
SonicOS Enhanced (SonicOSe) is the latest version of SonicWALL's
powerful SonicOS operating system, designed for the next generation of
SonicWALL firewall/VPN appliances.
A format string vulnerability exists in the logfile parsing function of
SonicOS. An attacker could crash the system or execute arbitrary code by
injecting format string metacharacters into the logfile, if an
administrator subsequently uses the SonicOS GUI to view the log.
Proof of concept:
There are multiple ways to inject format string characters into the
logs. The following methods can be used to test for the vulnerability:
1. CFS: Add ebay.com to your "Forbidden Domains" and access
2. GroupVPN: Establish an GroupVPN Tunnel and enter at the XAUTH
3. Webfrontend: Enter at the Login Page of your SonicWALL as Username %s
SEC Consult will not release code execution exploits for this
vulnerability to the public.
Vendor contact timeline:
2006: Vulnerability found
2006.10.25: Vulnerability first reported to vendor
2009.02.17: Vulnerability reported to vendor again
2009.03.16: Request for status update
2009.04.21: Request for status update
2009.05.25: Public Release
SEC Consult was not able to get any vendor feedback on this issue. We
are currently not aware of a patch or workaround.
SEC Consult Unternehmensberatung GmbH
Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
EOF SEC Consult Vulnerability Lab / @2009