SonicWall Fixes Critical Flaw in Firewall Appliances

guest · Oct 16, 2020

SonicWall Fixes Critical Flaw in Firewall Appliances
October 15, 2020
https://duo.com/decipher/sonicwall-fixes-critical-flaw-in-firewall-appliances

There is a critical remotely exploitable vulnerability in several versions of SonicWall’s SonicOS software that could allow an attacker to run arbitrary code on vulnerable appliances.

The recently disclosed vulnerability (CVE-2020-5135) is a stack buffer overflow and it can be used to cause a denial of service condition easily, though the code execution potential is more complicated.

“The flaw can be triggered by an unauthenticated HTTP request involving a custom protocol handler. The vulnerability exists within the HTTP/HTTPS service used for product management as well as SSL VPN remote access,” an advisory from Craig Young at Tripwire, who discovered the vulnerability, says.
Click to expand...

The vulnerability is particularly worrisome given that the affected appliances often are used for remote access via the SSL VPN functionality. An attacker who is able to compromise a VPN appliance would have a highly privileged position in the target network and the ability to discover other assets and potential targets.
Click to expand...

SonicWall VPN Portal Critical Flaw (CVE-2020-5135)

An unskilled attacker can use this flaw to cause a persistent denial of service condition.
This flaw exists pre-authentication and within a component (SSLVPN) which is typically exposed to the public Internet. As of the date of discovery, a Shodan search for the affected HTTP server banner indicated 795,357 hosts.
Click to expand...

guest · Oct 23, 2020

Positive Technologies helps fix 11 vulnerabilities in popular SonicWall firewall appliances
October 22, 2020
https://www.ptsecurity.com/ww-en/ab...ies-in-popular-sonicwall-firewall-appliances/

SonicWall patched vulnerabilities in SonicOS for firewall appliances discovered by Positive Technologies expert Nikita Abramov. According to IDC, SonicWall ranks fifth among manufacturers of gateway security appliance solutions worldwide.

The most serious vulnerability, CVE-2020-5135, found by Nikita Abramov at Positive Technologies and Craig Young at Tripwire, is of critical severity (CVSS v3 score 9.4). This buffer overflow vulnerability in SonicOS allows remote attackers to cause denial of service (DoS) and potentially execute arbitrary code.

Nikita Abramov researcher at Positive Technologies explained: "The tested solution uses a SSL-VPN remote access service on firewalls, and users can be disconnected from internal networks and their workstations in case of a DoS attack. If attackers manage to execute arbitrary code, they may be able to develop an attack and penetrate the company's internal networks."
Click to expand...

Another vulnerability, CVE-2020-5133, received a CVSS v3 score of 8.2. This vulnerability allows a remote unauthenticated attacker to cause denial of service attacks due to buffer overflow, which leads to a firewall crash. [...]
Click to expand...

Sonicwall: SonicWall DoS & XSS Vulnerabilities

The SonicWall Product Security Incident Response Team (PSIRT) collaborated with a third-party research firm to test, confirm and correct discovered vulnerabilities related to physical and virtual SonicWall next-generation firewall appliances. These findings included:

In some cases, vulnerabilities allowed remote attackers to cause Denial of Service (DoS) attacks against a firewall, which may lead to an appliance crash.

In some cases, there existed a cross-site scripting (XSS) vulnerability in the firewall's SSL-VPN portal as well as possible username enumeration of firewall administrators.

Click to expand...

guest · Jun 22, 2021

SonicWall bug that affected 800K firewalls was only partially fixed
June 22, 2021
https://www.bleepingcomputer.com/ne...cted-800k-firewalls-was-only-partially-fixed/

New findings have emerged that shed light on a critical SonicWall vulnerability disclosed last year, which was initially thought to have been patched.

In October last year, a critical stack-based Buffer Overflow vulnerability, tracked as CVE-2020-5135, was discovered affecting over 800,000 SonicWall VPNs.
Turns out, the vulnerability was not properly patched—until now.

As such a new vulnerability identifier, CVE-2021-20019 has been assigned to the flaw.
Click to expand...

SonicWall bug in 800K VPN firewalls was only partially fixed
In October last year, BleepingComputer reported on a critical stack-based Buffer Overflow vulnerability in SonicWall VPN firewalls.

The vulnerability, tracked as CVE-2020-5135, was present in versions of SonicOS, ran by over 800,000 active SonicWall devices.
Craig Young of Tripwire Vulnerability and Exposure Research Team (VERT), and Nikita Abramov of Positive Technologies were initially credited with discovering and reporting the vulnerability.

But, now, Tripwire has reached out to BleepingComputer, claiming the previously made fix for the flaw was "unsuccessful."
Click to expand...

"In some past research, I have observed differences in vulnerable behavior related to hardware-based acceleration utilizing a separate code path," says Young in a blog post.
This is when Young reached out to SonicWall again for a remedy.

SonicWall has now released advisories [1, 2] related to this vulnerability today, with further information on the fixed versions.
Although most versions have a patch available, platforms including NSsp 12K, SuperMassive 10k, and SuperMassive 9800 are awaiting a patch release.
Click to expand...

Tripwire: Analyzing SonicWall’s Unsuccessful Fix for CVE-2020-5135

Log in or Sign up

SonicWall Fixes Critical Flaw in Firewall Appliances

guest Guest

guest Guest

guest Guest

Log in or Sign up

SonicWall Fixes Critical Flaw in Firewall Appliances

guest Guest

guest Guest

guest Guest

Useful Searches