SonicWall SonicOS HTTP server: authenticated request overflows the stack via sscanf and crashes it

Impact

An authenticated remote user sends a request that the SonicOS HTTP server parses with sscanf, overflowing the stack and causing a denial of service. Anyone with valid credentials can take down the firewall, and with it management access and the traffic behind it. The record describes denial of service only.

Who can reach it

Authenticated remote user able to reach the SonicOS HTTP management interface.

What to do

Flash the fixed SonicOS firmware listed in SonicWall advisory SNWLID-2024-0008. The appliance reboots during the upgrade. Restricting the management interface to trusted networks narrows who can reach it.

References

Related entries

• IBM OpenBMC bmcweb HTTPS server (FW1050.00 - FW1050.10): Certain URIs on IBM's OpenBMC-derived bmcweb returnCVE-2024-31916 · IBM OpenBMC bmcweb HTTPS server (FW1050.00 - FW1050.10)High
• IBM OpenBMC default password and session management (FW1020, FW1030, FW1050): The combination of a shipped defaultCVE-2024-35124 · IBM OpenBMC default password and session management (FW1020, FW1030, FW1050)High
• Supermicro BIOS (arbitrary memory write, X11DPH series): Arbitrary memory write from firmware context on X11DPH boardsCVE-2024-36433 · Supermicro BIOS (arbitrary memory write, X11DPH series)High
• Supermicro BIOS SMM callout (X11DPH-T / X11DPH-Tq): Execution in System Management Mode, the most privileged executionCVE-2024-36434 · Supermicro BIOS SMM callout (X11DPH-T / X11DPH-Tq)High
• Dell SmartFabric OS10 (uncontrolled resource consumption): A remote unauthenticated host can exhaust resources on anCVE-2024-37125 · Dell SmartFabric OS10 (uncontrolled resource consumption)High
• Sunbird DCIM dcTrack v9.1.2 - ticket location RBAC: Incorrect access control lets an attacker create or update ticketsCVE-2024-37775 · Sunbird DCIM dcTrack v9.1.2 - ticket location RBACHigh