A vulnerability has been reported in various SonicWALL products, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via a URL is not properly sanitised before being returned in a Content Filtering Service message that a site is blocked. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a requested site.

The vulnerability is reported in SonicWALL products running SonicOS versions prior to 4.0.1.1.

Solution
Update to SonicOS version 4.0.1.1 or later.

Provided and/or discovered by
Adrian Pastor, reported via ZDI

Changelog
Further details available to Secunia VIM customers

Original Advisory
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-08-070/

SonicWALL:
http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdf

Deep Links
Links available to Secunia VIM customers