A vulnerability has been reported in SonicWALL SSL-VPN 200, 2000, and 4000, which can be exploited by malicious people to disclose potentially sensitive information, cause a DoS (Denial of Service), and potentially compromise a vulnerable system.

The vulnerability is caused due to a format string error within the portal login pages (or legacy portal login pages for SSL-VPN 2000 and 4000). This can be exploited by e.g. passing a specially crafted string containing format string specifier to the "err" parameter of cgi-bin/welcome/VirtualOffice.

The vulnerability is reported in SSL-VPN 200 with firmware version 2.1 through 3.0.0.8, SSL-VPN 2000 and 4000 with firmware version 2.1 through 3.0.0.10, and SSL-VPN 2000 and 4000 legacy portals with firmware version 3.5.0.0 through 3.5.0.4.

Note: The "new look and feel portals" for SSL-VPN 2000 and 4000 are reportedly not affected.

Solution
Apply updated firmware.
Further details available in Customer Area

Provided and/or discovered by
Patrick Webster

Original Advisory
http://www.aushack.com/200905-sonicwall.txt

Deep Links
Links available in Customer Area