SonicWall SonicOS: stack overflow via HTTP Content-Length header, DoS and possible code execution

Impact

An authenticated attacker can overflow a stack buffer through the HTTP Content-Length response header. That crashes the firewall and may give code execution on it. A compromised perimeter or segmentation firewall gives the attacker a foothold to watch or redirect traffic into management and tenant networks. SonicOS Gen 5, Gen 6 and Gen 7 are affected.

Who can reach it

Remote, but it needs an authenticated session on the firewall's HTTP interface.

What to do

Upgrade SonicOS to the fixed firmware in SNWLID-2021-0027. That is a firewall firmware upgrade and reboot, or a failover to an HA peer. Limit management interface access to trusted hosts.

References

Related entries

• SonicWall SonicOS: stack overflow via SessionID HTTP header, DoS and possible code executionCVE-2021-20048 · SonicWall SonicOS (SessionID HTTP response header handling)High
• Cisco NX-OS / FXOS (Cisco Discovery Protocol): Root code execution on the switch from a crafted CDP frame sentCVE-2022-20824 · Cisco NX-OS / FXOS (Cisco Discovery Protocol)High
• HPE iLO 5 (adjacent-network code execution / DoS): Arbitrary code execution on the iLO from an adjacent networkCVE-2022-28639 · HPE iLO 5 (adjacent-network code execution / DoS)High
• Intel Server Platform Services (SPS) firmware: Active debug code left enabled in shipped SPS firmware letsCVE-2022-36348 · Intel Server Platform Services (SPS) firmwareHigh
• Linux kernel (drivers/infiniband/hw/hfi1): The node panics when the fabric link goes down while any sender is waitingCVE-2022-49931 · Linux kernel (drivers/infiniband/hw/hfi1)High
• SonicWall SonicOS SSLVPN: no limit on MFA code attemptsCVE-2023-1101 · SonicWall SonicOS (SSLVPN MFA)High