SonicWALL Global VPN Client Remote Format-String Vulnerability

vendor:

Global VPN Client

by:

SecurityFocus

7.5

CVSS

HIGH

Format-String Vulnerability

134

CWE

Product Name: Global VPN Client

Affected Version From: 4.0.0.2-51e Standard and Enhanced

Affected Version To: Other versions may also be affected.

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2008

SonicWALL Global VPN Client Remote Format-String Vulnerability

SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function. Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application. Failed attempts may cause denial-of-service conditions.

Mitigation:

Input validation should be used to ensure that untrusted input is rejected.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/35093/info

SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application. Failed attempts may cause denial-of-service conditions.

Global VPN Client 4.0.0.2-51e Standard and Enhanced are vulnerable; other versions may also be affected. 

The following proofs of concept are available:

1. CFS: Add example.com to your "Forbidden Domains" and access http://www.example.com/%s%s%s%s%s%s/.

2. GroupVPN: Establish a GroupVPN Tunnel and enter at the XAUTH Username %s%s%s%s%s.

3. Webfrontend: Enter at the Login Page of your SonicWALL as Username %s%s%s%s%s