----------------------------------------------------------------------

2003: 2,700 advisories published
2004: 3,100 advisories published
2005: 4,600 advisories published
2006: 5,300 advisories published

How do you know which Secunia advisories are important to you?

The Secunia Vulnerability Intelligence Solutions allows you to filter
and structure all the information you need, so you can address issues
effectively.

Get a free trial of the Secunia Vulnerability Intelligence Solutions:
http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv

----------------------------------------------------------------------

TITLE:
SonicWALL SSL VPN ActiveX Controls Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA27469

VERIFY ADVISORY:
http://secunia.com/advisories/27469/

CRITICAL:
Highly critical

IMPACT:
Manipulation of data, System access

WHERE:
>From remote

OPERATING SYSTEM:
SonicWALL SSL-VPN 2000 2.x
http://secunia.com/product/9056/
SonicWALL SSL-VPN 200 2.x
http://secunia.com/product/16416/
SonicWALL SSL-VPN 4000 2.x
http://secunia.com/product/16417/

DESCRIPTION:
Some vulnerabilities have been reported in SonicWALL SSL VPN, which
can be exploited by malicious people to delete arbitrary files or to
compromise a user's system.

1) Boundary errors within the NetExtender NELaunchCtrl ActiveX
control when handling arguments passed to certain methods (e.g.
"AddRouteEntry()", "serverAddress()", "sessionId()",
"clientIPLower()", "clientIPHigher()", "userName()", "domainName()",
and "dnsSuffix()") can be exploited to cause buffer overflows when a
user e.g. visits a malicious website.

2) The WebCacheCleaner ActiveX control includes the insecure method
"FileDelete()", which can be exploited to delete arbitrary files.

The vulnerabilities are reported in WebCacheCleaner ActiveX control
version 1.3.0.3 and NeLaunchCtrl ActiveX control version 2.1.0.49.
Other versions may also be affected.

SOLUTION:
Update to firmware version 2.5 for SonicWALL SSL VPN 2000/4000, and
version 2.1 for SonicWALL SSL-VPN 200.
http://www.sonicwall.com/us/643.htm

PROVIDED AND/OR DISCOVERED BY:
1) Independently discovered by:
* lofi42
* Will Dormann, CERT/CC ("AddRouteEntry()" method)
2) lofi42

ORIGINAL ADVISORY:
SEC Consult:
http://www.sec-consult.com/fileadmin/Advisories/20071101-0_sonicwall_multiple.txt

US-CERT VU#298521:
http://www.kb.cert.org/vuls/id/298521

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------