SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Device (Encryption/VPN)  >   SonicWALL Vendors:   SonicWALL
SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control Buffer Overflow Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1024666
SecurityTracker URL:  http://securitytracker.com/id/1024666
CVE Reference:   CVE-2010-2583   (Links to External Site)
Date:  Oct 29 2010
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in SonicWALL SSL-VPN. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a buffer overflow in the Install3rdPartyComponent() method in the 'Aventail.EPInstaller' ActiveX control and execute arbitrary code on the target system. The code will run with the privileges of the target user.

Version 10.5.1.117 of the ActiveX control is affected.

The vendor was notified on September 28, 2010.

Dmitriy Pletnev, Secunia Research, reported this vulnerability.

Impact:   A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued a fix (10.5.2; hotfix 3 for version 10.0.5).

The vendor's advisory is available at:

http://software.sonicwall.com/Aventail/KB/hotfix/10.0.5/clt-hotfix-10_0_5-003.txt

Vendor URL:  www.sonicwall.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  

Message History:   None.


 Source Message Contents

Date:  Fri, 29 Oct 2010 10:35:59 +0200
Subject:  [Full-disclosure] Secunia Research: SonicWALL SSL-VPN End-Point ActiveX Control Buffer Overflow

====================================================================== 

                     Secunia Research 29/10/2010

- SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control -
      - "Install3rdPartyComponent()" Method Buffer Overflow -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

====================================================================== 
1) Affected Software 

* SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control 
version 10.5.1.117

NOTE: Other versions may also be affected.

====================================================================== 
2) Severity 

Rating: Highly critical
Impact: System access
Where:  Remote

====================================================================== 
3) Vendor's Description of Software 

"The End-Point Interrogator/Installer ActiveX control provides 
software installation and interrogation functionality and is used by
the SonicWALL SSL-VPN E-Class remote access devices."

Product Link:
http://www.sonicwall.com/us/products/506.html

====================================================================== 
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in SonicWALL SSL-VPN
End-Point Interrogator/Installer ActiveX Control, which can be
exploited by malicious people to compromise a user's system.

The vulnerability is caused by a boundary error in the
"Install3rdPartyComponent()" method in the "Aventail.EPInstaller"
ActiveX control when creating an absolute path name based on values
in the "CabURL" and "Location" arguments. This can be exploited to
cause a stack-based buffer overflow via overly long values.

Successful exploitation allows execution of arbitrary code.

====================================================================== 
5) Solution 

Update to version 10.5.2 and apply hotfix 3 for version 10.0.5.

====================================================================== 
6) Time Table 

28/09/2010 - Vendor notified.
28/09/2010 - Vendor response.
10/10/2010 - Vendor confirms the vulnerability.
26/10/2010 - Vendor releases fixed version.
29/10/2010 - Public disclosure.

====================================================================== 
7) Credits 

Discovered by Dmitriy Pletnev, Secunia Research.

====================================================================== 
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2010-2583 for the vulnerability.

====================================================================== 
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private 
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the 
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

====================================================================== 
10) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2010-117/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC