Sign-up

ID

VAR-201011-0150


CVE

CVE-2010-2583


TITLE

SonicWALL SSL-VPN End-Point Vulnerable to stack-based buffer overflow

Trust: 0.8

sources: JVNDB: JVNDB-2010-002962

DESCRIPTION

Stack-based buffer overflow in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX control (Aventail.EPInstaller) before 10.5.2 and 10.0.5 hotfix 3 allows remote attackers to execute arbitrary code via long (1) CabURL and (2) Location arguments to the Install3rdPartyComponent method. The SonicWALL SSL-VPN E-Class ActiveX control is prone to multiple buffer-overflow vulnerabilities because the application fails to adequately check boundaries on user-supplied input. Failed attacks will likely cause denial-of-service conditions. These issues affects SonicWALL E-Class SSL-VPN 10.5.1.117 and all previous versions as well as 10.0.5 without hotfix; other versions may also be vulnerable. ====================================================================== 2) Severity Rating: Highly critical Impact: System access Where: Remote ====================================================================== 3) Vendor's Description of Software "The End-Point Interrogator/Installer ActiveX control provides software installation and interrogation functionality and is used by the SonicWALL SSL-VPN E-Class remote access devices." Product Link: http://www.sonicwall.com/us/products/506.html ====================================================================== 4) Description of Vulnerability Secunia Research has discovered a vulnerability in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control, which can be exploited by malicious people to compromise a user's system. This can be exploited to cause a stack-based buffer overflow via overly long values. Successful exploitation allows execution of arbitrary code. ====================================================================== 5) Solution Update to version 10.5.2 and apply hotfix 3 for version 10.0.5. ====================================================================== 6) Time Table 28/09/2010 - Vendor notified. 28/09/2010 - Vendor response. 10/10/2010 - Vendor confirms the vulnerability. 26/10/2010 - Vendor releases fixed version. 29/10/2010 - Public disclosure. ====================================================================== 7) Credits Discovered by Dmitriy Pletnev, Secunia Research. ====================================================================== 8) References The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2010-2583 for the vulnerability. ====================================================================== 9) About Secunia Secunia offers vulnerability management solutions to corporate customers with verified and reliable vulnerability intelligence relevant to their specific system configuration: http://secunia.com/advisories/business_solutions/ Secunia also provides a publicly accessible and comprehensive advisory database as a service to the security community and private individuals, who are interested in or concerned about IT-security. http://secunia.com/advisories/ Secunia believes that it is important to support the community and to do active vulnerability research in order to aid improving the security and reliability of software in general: http://secunia.com/secunia_research/ Secunia regularly hires new skilled team members. Check the URL below to see currently vacant positions: http://secunia.com/corporate/jobs/ Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/advisories/mailing_lists/ ====================================================================== 10) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2010-117/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ====================================================================== _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM) Beta. Join the beta: http://secunia.com/products/corporate/vim/ ---------------------------------------------------------------------- TITLE: SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control Buffer Overflow SECUNIA ADVISORY ID: SA41644 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/41644/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=41644 RELEASE DATE: 2010-10-30 DISCUSS ADVISORY: http://secunia.com/advisories/41644/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/41644/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=41644 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Secunia Research has discovered a vulnerability in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control, which can be exploited by malicious people to compromise a user's system. ORIGINAL ADVISORY: SonicWALL: http://software.sonicwall.com/Aventail/KB/hotfix/10.0.5/clt-hotfix-10_0_5-003.txt Secunia Research: http://secunia.com/secunia_research/2010-117/ OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.16

sources: NVD: CVE-2010-2583 // JVNDB: JVNDB-2010-002962 // BID: 44535 // VULHUB: VHN-45188 // PACKETSTORM: 95286 // PACKETSTORM: 95300

AFFECTED PRODUCTS

vendor:sonicwallmodel:ssl-vpn end-point interrogator\/installer activex controlscope:eqversion:10.0.5

Trust: 1.6

vendor:sonicwallmodel:ssl-vpn end-point interrogator\/installer activex controlscope:lteversion:10.5.1

Trust: 1.0

vendor:sonicwallmodel:ssl-vpn end-point interrogator/installer activex controlscope:ltversion:10.5.2

Trust: 0.8

vendor:sonicwallmodel:ssl-vpn end-point interrogator/installer activex controlscope:eqversion:and 10.0.5

Trust: 0.8

vendor:sonicwallmodel:ssl-vpn end-point interrogator\/installer activex controlscope:eqversion:10.5.1

Trust: 0.6

sources: JVNDB: JVNDB-2010-002962 // CNNVD: CNNVD-201011-019 // NVD: CVE-2010-2583

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2010-2583
value: HIGH

Trust: 1.0

NVD: CVE-2010-2583
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201011-019
value: CRITICAL

Trust: 0.6

VULHUB: VHN-45188
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2010-2583
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-45188
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-45188 // JVNDB: JVNDB-2010-002962 // CNNVD: CNNVD-201011-019 // NVD: CVE-2010-2583

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-45188 // JVNDB: JVNDB-2010-002962 // NVD: CVE-2010-2583

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201011-019

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201011-019

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2010-002962

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-45188

PATCH
title:clt-hotfix-10_0_5-003url:http://software.sonicwall.com/Aventail/KB/hotfix/10.0.5/clt-hotfix-10_0_5-003.txt
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2010-002962

EXTERNAL IDS
db:NVDid:CVE-2010-2583
Trust: 2.9
db:BIDid:44535
Trust: 2.0
db:SECUNIAid:41644
Trust: 1.8
db:SECTRACKid:1024666
Trust: 1.7
db:JVNDBid:JVNDB-2010-002962
Trust: 0.8
db:CNNVDid:CNNVD-201011-019
Trust: 0.7
db:XFid:62865
Trust: 0.6
db:BUGTRAQid:20101029 SECUNIA RESEARCH: SONICWALL SSL-VPN END-POINT ACTIVEX CONTROL BUFFER OVERFLOW
Trust: 0.6
db:NSFOCUSid:15957
Trust: 0.6
db:PACKETSTORMid:95286
Trust: 0.2
db:VULHUBid:VHN-45188
Trust: 0.1
db:PACKETSTORMid:95300
Trust: 0.1
sources:
            
            
            VULHUB: VHN-45188 // 
            
            
            
            BID: 44535 // 
            
            
            
            JVNDB: JVNDB-2010-002962 // 
            
            
            
            PACKETSTORM: 95286 // 
            
            
            
            PACKETSTORM: 95300 // 
            
            
            
            CNNVD: CNNVD-201011-019 // 
            
            
            
            NVD: CVE-2010-2583

REFERENCES
url:http://secunia.com/secunia_research/2010-117/
Trust: 2.2
url:http://software.sonicwall.com/aventail/kb/hotfix/10.0.5/clt-hotfix-10_0_5-003.txt
Trust: 2.1
url:http://www.securityfocus.com/bid/44535
Trust: 1.7
url:http://www.securitytracker.com/id?1024666
Trust: 1.7
url:http://secunia.com/advisories/41644
Trust: 1.7
url:http://www.securityfocus.com/archive/1/514561/100/0/threaded
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/62865
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2583
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-2583
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/62865
Trust: 0.6
url:http://www.securityfocus.com/archive/1/archive/1/514561/100/0/threaded
Trust: 0.6
url:http://www.nsfocus.net/vulndb/15957
Trust: 0.6
url:http://www.sonicwall.com/
Trust: 0.3
url:http://secunia.com/secunia_research/
Trust: 0.1
url:http://secunia.com/corporate/jobs/
Trust: 0.1
url:http://secunia.com/advisories/mailing_lists/
Trust: 0.1
url:http://secunia.com/advisories/
Trust: 0.1
url:http://secunia.com/
Trust: 0.1
url:http://secunia.com/advisories/business_solutions/
Trust: 0.1
url:http://www.sonicwall.com/us/products/506.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-2583
Trust: 0.1
url:http://lists.grok.org.uk/full-disclosure-charter.html
Trust: 0.1
url:http://secunia.com/advisories/41644/
Trust: 0.1
url:http://secunia.com/products/corporate/evm/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/products/corporate/vim/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/advisories/41644/#comments
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=41644
Trust: 0.1
sources:
            
            
            VULHUB: VHN-45188 // 
            
            
            
            BID: 44535 // 
            
            
            
            JVNDB: JVNDB-2010-002962 // 
            
            
            
            PACKETSTORM: 95286 // 
            
            
            
            PACKETSTORM: 95300 // 
            
            
            
            CNNVD: CNNVD-201011-019 // 
            
            
            
            NVD: CVE-2010-2583

CREDITS
Dmitriy Pletnev
Trust: 0.7
sources:
            
            
            PACKETSTORM: 95286 // 
            
            
            
            CNNVD: CNNVD-201011-019

SOURCES
db:VULHUBid:VHN-45188
db:BIDid:44535
db:JVNDBid:JVNDB-2010-002962
db:PACKETSTORMid:95286
db:PACKETSTORMid:95300
db:CNNVDid:CNNVD-201011-019
db:NVDid:CVE-2010-2583

LAST UPDATE DATE
2025-04-11T23:17:56.935000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-45188date:2018-10-10T00:00:00
db:BIDid:44535date:2010-10-29T00:00:00
db:JVNDBid:JVNDB-2010-002962date:2012-03-27T00:00:00
db:CNNVDid:CNNVD-201011-019date:2010-11-04T00:00:00
db:NVDid:CVE-2010-2583date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-45188date:2010-11-03T00:00:00
db:BIDid:44535date:2010-10-29T00:00:00
db:JVNDBid:JVNDB-2010-002962date:2012-03-27T00:00:00
db:PACKETSTORMid:95286date:2010-10-29T16:19:49
db:PACKETSTORMid:95300date:2010-11-01T01:35:05
db:CNNVDid:CNNVD-201011-019date:2010-11-04T00:00:00
db:NVDid:CVE-2010-2583date:2010-11-03T13:37:08.700