what you don't know can hurt you
Showing 1 - 1 of 1 RSS Feed


SonciWALL Aventail epi.dll AuthCredential Format String Exploit
Posted Aug 21, 2010
Authored by Nikolas Sotiriu, jduck | Site metasploit.com

This Metasploit module exploits a format string vulnerability within version 10.0.4.x and 10.5.1 of the SonicWALL Aventail SSL-VPN Endpoint Interrogator/Installer ActiveX control (epi.dll). By calling the 'AuthCredential' method with a specially crafted Unicode format string, an attacker can cause memory corruption and execute arbitrary code. Unfortunately, it does not appear to be possible to indirectly re-use existing stack data for more reliable exploitation. This is due to several particulars about this vulnerability. First, the format string must be a Unicode string, which uses two bytes per character. Second, the buffer is allocated on the stack using the 'alloca' function. As such, each additional format specifier (%x) will add four more bytes to the size allocated. This results in the inability to move the read pointer outside of the buffer. Further testing showed that using specifiers that pop more than four bytes does not help. Any number of format specifiers will result in accessing the same value within the buffer. NOTE: It may be possible to leverage the vulnerability to leak memory contents. However, that has not been fully investigated at this time.

tags | exploit, arbitrary, activex
MD5 | ed696145b958ba72cb078d78d73be31f
Page 1 of 1

Top Authors In Last 30 Days

Recent News

News RSS Feed
No, You Don't Need A Burner Phone At A Hacking Conference
Posted Jul 18, 2019

tags | headline, hacker, privacy, phone, conference
Unofficial Telegram App Secretly Loads Malicious Sites
Posted Jul 17, 2019

tags | headline, malware, phone
Bluetooth Exploit Can Track And Identify Mobile Device Users
Posted Jul 17, 2019

tags | headline, privacy, wireless, spyware
Elon Musk Reveals Brain Hacking Plans
Posted Jul 17, 2019

tags | headline, hacker, science
JetBlue Bomb Scare Set Off With Apple AirDrop
Posted Jul 17, 2019

tags | headline, apple, terror
MyDashWallet Compromised For Two Months, Wallet Keys Taken
Posted Jul 16, 2019

tags | headline, cybercrime, data loss, fraud, cryptography
Office 365 Declared Illegal In German Schools Due To Privacy Risks
Posted Jul 16, 2019

tags | headline, government, privacy, microsoft, flaw, germany
Amadeus Airline Check-In Bug Exposed Boarding Passes
Posted Jul 16, 2019

tags | headline, privacy, data loss, spyware, terror
Sprint Says Hackers Breached Customer Accounts Via Samsung Website
Posted Jul 16, 2019

tags | headline, hacker, privacy, phone, data loss, samsung
Bitcoin Drops 10 Percent As Scrutiny Grows
Posted Jul 15, 2019

tags | headline, bank, cryptography
View More News →
packet storm

© 2019 Packet Storm. All rights reserved.

Security Services
Hosting By