Multiple vulnerabilities have been discovered in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control, which can be exploited by malicious people to compromise a user's system.

1) A format string error in epi.dll when creating a log message can be exploited via a specially crafted string e.g. assigned to the "AuthCredential" property of the "Aventail.EPInterrogator" control.

2) Two boundary errors in the "InstallComponentMsi()" method when processing the "serverIP" and "MsiURL" arguments can be exploited to cause a stack-based buffer overflow via an overly long string (greater than 8192 bytes).

3) Five boundary errors in the "Install3rdPartyComponent()" method when processing the "CabURL", "FileName", "ClassID", "VersionString", and "Location" arguments can be exploited to cause a stack-based buffer overflow via an overly long string (greater than 8192 bytes).

4) Three boundary errors in the "InstallComponentVer()" method when processing the "CabURL", "VersionString", and "Location" arguments can be exploited to cause a stack-based buffer overflow via an overly long string (greater than 8192 bytes).

5) Five boundary errors in the "InstallComponent()" method when processing the "CabURL", "FileName", "ClassID", "VersionString", and "Location" arguments can be exploited to cause a stack-based buffer overflow via an overly long string (greater than 8192 bytes).

Successful exploitation of these vulnerabilities allows execution of arbitrary code.

The vulnerabilities are reported in versions prior to 10.0.5 (confirmed in 10.0.4.35) and in version 10.5.1 without the hotfix.

Solution
Update to version 10.0.5 and apply hotfix for version 10.5.1.

Provided and/or discovered by
1) Nikolas Sotiriu
2-5) Silently fixed by the vendor.

Additional details provided by Secunia Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Nikolas Sotiriu:
http://sotiriu.de/adv/NSOADV-2010-005.txt

SonicWALL:
http://www.sonicwall.com/us/support/kb.asp?kbid=8272

Technical Analysis
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers