SB2020101601 - Multiple vulnerabilities in SonicWall SonicOS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020101601

SB2020101601 - Multiple vulnerabilities in SonicWall SonicOS

Published: October 16, 2020

Security Bulletin ID SB2020101601
Severity
Critical
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Critical 9% High 55% Medium 27% Low 9%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 secuirty vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2020-5142)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the SSLVPN web interface. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


2) Improper control of interaction frequency (CVE-ID: CVE-2020-5141)

The vulnerability allows a remote attacker to perform a brute-force attack.

The vulnerability exists due to usage of predictable Virtual Assist ticket identifiers and lack of anti-automation protection. A remote non-authenticated attacker can brute-force the Virtual Assist ticket ID in the firewall SSLVPN service.


3) Out-of-bounds read (CVE-ID: CVE-2020-5140)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the SSLVPN service when processing HTTP requests. A remote non-authenticated attacker can send specially crafted HTTP request to the device and crash it.


4) Untrusted Pointer Dereference (CVE-ID: CVE-2020-5139)

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to untrusted pointer dereference within the SSLVPN service. A remote non-authenticated attacker can send a specially crafted request to the device and crash it.


5) Heap-based buffer overflow (CVE-ID: CVE-2020-5138)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the SSLVPN service. A remote non-authenticated attacker can send specially crafted request to the device and crash it.


6) Buffer overflow (CVE-ID: CVE-2020-5137)

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to a boundary error when processing requests within the SSLVPN service. A remote non-authenticated attacker can send specially crafted request to the system and crash it.


7) Buffer overflow (CVE-ID: CVE-2020-5136)

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to a boundary error when processing requests. A remote non-authenticated attacker can send specially crafted request to the SSL-VPN and virtual assist portal, trigger memory corruption and crash the system.



8) Buffer overflow (CVE-ID: CVE-2020-5135)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing requests. A remote non-authenticated attacker can send specially crafted request to the system, trigger memory corruption and crash the firewall or execute arbitrary code on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


9) Out-of-bounds read (CVE-ID: CVE-2020-5134)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition. A remote authenticated user can send specially crafted request to the system, trigger an out-of-bound invalid file reference and perform a denial of service (DoS) attack.


10) Information disclosure (CVE-ID: CVE-2020-5143)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application on the SonicOS SSLVPN login page. A remote attacker can enumerate firewall administrators based on returned responses.


11) Buffer overflow (CVE-ID: CVE-2020-5133)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary when processing network traffic. A remote non-authenticated attacker can send specially crafted traffic to the device and crash the firewall.


Remediation

Install update from vendor's website.

References