SB2023101650 - Multiple vulnerabilities in SonicWall SonicOS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023101650

SB2023101650 - Multiple vulnerabilities in SonicWall SonicOS

Published: October 16, 2023

Security Bulletin ID SB2023101650
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Stack-based buffer overflow (CVE-ID: CVE-2023-39276)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the getBookmarkList.json endpoint. A remote authenticated user can send a specially crafted HTTP request to the affected URL, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.


2) Stack-based buffer overflow (CVE-ID: CVE-2023-39277)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the sonicflow.csv and appflowsessions.csv endpoints. A remote authenticated user can send a specially crafted HTTP request to the affected URL, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.

3) Reachable Assertion (CVE-ID: CVE-2023-39278)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the main.cgi script. A remote authenticated user can send a specially crafted HTTP request to the affected URL and perform a denial of service (DoS) attack.


4) Stack-based buffer overflow (CVE-ID: CVE-2023-39279)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the getPacketReplayData.json URL endpoint. A remote authenticated user can send a specially crafted HTTP request to the affected URL, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.

5) Stack-based buffer overflow (CVE-ID: CVE-2023-39280)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the ssoStats-s.xml and ssoStats-s.wri endpoints. A remote authenticated user can send a specially crafted HTTP request to the affected URL, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.

6) Stack-based buffer overflow (CVE-ID: CVE-2023-41711)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the sonicwall.exp and prefs.exp endpoints. A remote authenticated user can send a specially crafted HTTP request to the affected URL, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.



7) Stack-based buffer overflow (CVE-ID: CVE-2023-41712)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the SSL VPN's plainprefs.exp URL endpoint. A remote authenticated user can send a specially crafted HTTP request to the affected URL, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.

8) Use of Hard-coded Password (CVE-ID: CVE-2023-41713)

CWE-ID: CWE-259 - Use of Hard-coded Password

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of hard-coded password in "dynHandleBuyToolbar" demo function. A remote attacker can gain access to sensitive information on the device.


9) Improper Privilege Management (CVE-ID: CVE-2023-41715)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges within the tunnel.

The vulnerability exists due to improper privilege management in the SonicOS SSL VPN Tunnel. A remote authenticated user can gain elevated privileges inside the tunnel.


Remediation

Install update from vendor's website.

References