{ "file_item": { "filepath": "security-advisories", "filename": "CERT-EU-SA2021-066.pdf" }, "title": "SonicWall Critical Vulnerabilities", "serial_number": "2021-066", "publish_date": "10-12-2021 10:28:00", "description": "On December 7th, SonicWall released security patches to address several security vulnerabilities. This list includes a critical unauthenticated stack-based buffer overflow vulnerability (CVE-2021-20038) with a CVSS score of 9.8 out of 10. If exploited, it could allow a remote unauthenticated attacker to execute code as a \"nobody\" user in the appliance.
There is another group of vulnerabilities, collectively tracked as CVE-2021-20045, which has a combined critical CVSS score of 9.4 out of 10. They could allow a remote unauthenticated attacker to cause heap-based and stack-based buffer overflow that would result in code execution as the \"nobody\" user.
According to SonicWall, there is no evidence that this vulnerability is being exploited in the wild.", "url_title": "2021-066", "content_markdown": "---\ntitle: 'SonicWall Critical Vulnerabilities'\nversion: '1.0'\nnumber: '2021-066'\ndate: 'December 10, 2021'\n---\n\n_History:_\n\n* _10/12/2021 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn December 7th, SonicWall released security patches to address several security vulnerabilities [1]. This list includes a critical unauthenticated stack-based buffer overflow vulnerability (CVE-2021-20038) with a CVSS score of 9.8 out of 10. If exploited, it could allow a remote unauthenticated attacker to execute code as a `nobody` user in the appliance.\n\nThere is another group of vulnerabilities, collectively tracked as CVE-2021-20045, which has a combined critical CVSS score of 9.4 out of 10. They could allow a remote unauthenticated attacker to cause heap-based and stack-based buffer overflow that would result in code execution as the `nobody` user [2].\n\nAccording to SonicWall, there is no evidence that this vulnerability is being exploited in the wild.\n\n# Technical Details\n\n## CVE-2021-20038\n\nThis vulnerability is due to the SonicWall SMA SSLVPN Apache HTTPD server GET method of `mod_cgi` module environment variables use a single stack-based buffer using `strcat` [1].\n\n## CVE-2021-20045\n\nThis vulnerability is due to the `sonicfiles` `RAC_COPY_TO` (`RacNumber 36`) method which allows users to upload files to an SMB share and can be called without any authentication. `RacNumber 36` of the `sonicfiles` API maps to the `upload_file` Python method and this is associated with `filexplorer` binary. This is a custom program written in C++ which is vulnerable to a number of memory safety issues.\n\n# Affected Products\n\nThis vulnerability affects SMA100 series:\n\n- SMA 200, 210, 400, 410 and 500v products versions `9.0.0.11-31sv*` and earlier, `10.2.0.8-37sv`, `10.2.1.1-19sv`, `10.2.1.2-24sv` and earlier.\n- SMA 100 series appliances with WAF enabled are also impacted by the majority of these vulnerabilities.\n\n# Recommendations\n\nSupport for `9.0.0` firmware ended on 10/31/2021. Customers still using that firmware are requested to upgrade to the latest `10.2.x` versions.\n\nCERT-EU strongly recommends to upgrade your affected appliance(s) to the fixed versions of the firmware (SMA `10.2.0.9-41sv`, `10.2.1.3-27sv`).\n\n# References\n\n[1] \n\n[2] \n", "content_html": "

History:

Summary

On December 7th, SonicWall released security patches to address several security vulnerabilities [1]. This list includes a critical unauthenticated stack-based buffer overflow vulnerability (CVE-2021-20038) with a CVSS score of 9.8 out of 10. If exploited, it could allow a remote unauthenticated attacker to execute code as a nobody user in the appliance.

There is another group of vulnerabilities, collectively tracked as CVE-2021-20045, which has a combined critical CVSS score of 9.4 out of 10. They could allow a remote unauthenticated attacker to cause heap-based and stack-based buffer overflow that would result in code execution as the nobody user [2].

According to SonicWall, there is no evidence that this vulnerability is being exploited in the wild.

Technical Details

CVE-2021-20038

This vulnerability is due to the SonicWall SMA SSLVPN Apache HTTPD server GET method of mod_cgi module environment variables use a single stack-based buffer using strcat [1].

CVE-2021-20045

This vulnerability is due to the sonicfiles RAC_COPY_TO (RacNumber 36) method which allows users to upload files to an SMB share and can be called without any authentication. RacNumber 36 of the sonicfiles API maps to the upload_file Python method and this is associated with filexplorer binary. This is a custom program written in C++ which is vulnerable to a number of memory safety issues.

Affected Products

This vulnerability affects SMA100 series:

Recommendations

Support for 9.0.0 firmware ended on 10/31/2021. Customers still using that firmware are requested to upgrade to the latest 10.2.x versions.

CERT-EU strongly recommends to upgrade your affected appliance(s) to the fixed versions of the firmware (SMA 10.2.0.9-41sv, 10.2.1.3-27sv).

References

[1] https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026

[2] https://threatpost.com/critical-sonicwall-vpn-bugs-appliance-takeover/176869/

", "licence": { "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)", "link": "https://creativecommons.org/licenses/by/4.0/", "restrictions": "https://cert.europa.eu/legal-notice", "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies" } }