[25486] in bugtraq
Sonicwall SOHO Content Blocking Script Injection, LogFile Denial of Service
daemon@ATHENA.MIT.EDU (E M)
Fri May 17 13:59:07 2002
From: "E M" <rdnktrk@hotmail.com>
To: bugtraq@securityfocus.com
Cc: vuln-dev@securityfocus.com
Date: Fri, 17 May 2002 08:55:33 -0700
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
Message-ID: <F71l6frSHnlLMEndfwC000068d8@hotmail.com>
This advisory may be reproduced unmodified.
Sonicwall SOHO Content Blocking Script Injection and Logfile DoS
Test Unit :
Sonicwall SOHO3
Firmware version: 6.3.0.0
ROM version: 5.0.1.0
Severity : Medium
Issue :
Sonicwall Allows administrators to block websites based on a user entered
list of domains. These websites are blocked whenever they accessed by
clients on the LAN interface.
By passing a blocked URL injected script the attacker may execute scripts
automatically when the logfile is viewed.
The below example uses a commonly blocked ad server, please note this must
be in your blocked sites list and that any site that is blocked will work
fine.
bannerserver.gator.com/<SCRIPT>window.location.href="http://www.offroadwarehouse.com";</SCRIPT>
This will be injected into the logfile, when an Admin attempts to view the
log files they will be automatically redirected to the site of your choice.
Note that any <SCRIPT> is executed, for the example I show redirection as a
means of Denial of Service.
Resolution :
Only after rebooting the unit will you gain access to the logfiles, the log
is cleared on each reboot, thus you will be unable to locate the user on the
LAN segment who initiated the attack.
Mitigating Factors :
This attack must come from the Lan interface, which means that it is not
remotely exploitable, this conclusion may be false but will be tested
further.
Author :
Eric McCarty
rdnktrk@hotmail.com
_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com
