SonicWall SonicOS CFS: oversized 403 responses can be abused for HTTP denial of service

Impact

When a user requests a blocked resource, the Content Filtering Service sends back a very large 403 Forbidden response to the source address. An attacker can abuse this to cause an HTTP denial of service. Only firewalls with CFS enabled are affected. The record describes denial of service only.

Who can reach it

Unauthenticated remote attacker able to send requests through a firewall with CFS enabled.

What to do

Flash the fixed SonicOS firmware listed in SonicWall advisory SNWLID-2022-0004. The appliance reboots during the upgrade.

References

Related entries

• AMD SEV-SNP - VM_HSAVE_PA MSR validation: Insufficient validation of the VM_HSAVE_PA model-specific register lets aCVE-2022-23818 · AMD SEV-SNP - VM_HSAVE_PA MSR validationHigh
• OpenBMC bmcweb multipart_parser (Redfish / web UI HTTP front end): bmcweb is the single process behind Redfish, the webCVE-2022-2809 · OpenBMC bmcweb multipart_parser (Redfish / web UI HTTP front end)High
• AMI MegaRAC: User enumeration — lets an attacker map valid BMC accounts before credential attackCVE-2022-2827 · AMI MegaRACHigh
• Insyde InsydeH2O (UsbCoreDxe USB working buffer, DMA TOCTOU): UsbCoreDxe builds its USB transaction working bufferCVE-2022-30283 · Insyde InsydeH2O (UsbCoreDxe USB working buffer, DMA TOCTOU)High
• OpenBMC bmcweb multipart_parser (second variant found during the CVE-2022-2809 fix): The second bug the fuzzer foundCVE-2022-3409 · OpenBMC bmcweb multipart_parser (second variant found during the CVE-2022-2809 fix)High
• Dell Enterprise SONiC OS (SSH cryptographic key): A cryptographic key weakness in SONiC's SSH implementation letsCVE-2022-34425 · Dell Enterprise SONiC OS (SSH cryptographic key)High