SonicWALL E-Class SSL-VPN ActiveX Control Format String Vulnerability
Last Update Date:
28 Jan 2011
Release Date:
23 Aug 2010
4472
Views
RISK: Medium Risk
A vulnerability has been identified in SonicWALL E-Class SSL-VPN, which could be exploited by remote attackers to compromise an affected system. This issue is caused by a format string error in the Endpoint Interrogator/Installer ActiveX control (epi.dll) when processing data passed to the "AuthCredential()" or "ConfigurationString()" methods, which could be exploited by remote attackers to execute arbitrary code by tricking a user into visiting a specially crafted web page.
Impact
- Remote Code Execution
System / Technologies affected
- SonicWALL SSL-VPN E-Class EX Series version 10.5.1 and prior
- SonicWALL SSL-VPN E-Class EX Series version 10.0.4 and prior
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- Upgrade to SonicWALL SSL-VPN E-Class EX Series version 10.0.5 or apply hotfix for version 10.5.1:
http://www.sonicwall.com/us/support/kb.asp?kbid=8272
Vulnerability Identifier
- No CVE information is available
Source
Related Link
Share with