If you want to practice writing exploits and worms, there's a big hijacking hole in SonicWall firewall VPNs

And some 800,000 installations facing the internet, patches are available

A critical vulnerability in a SonicWall enterprise VPN firewall can be exploited to crash the device or remotely execute code on it, reverse engineers said this week.

The stack-based buffer overflow (CVE-2020-5135) uncovered by infosec outfit Tripwire can be triggered by an “unauthenticated HTTP request involving a custom protocol handler” – and, most worryingly, could have been deployed by an “unskilled attacker.”

The biz said about 800,000 devices were discoverable through device search engine Shodan.io at the time it made its findings, which are lightly detailed on its blog.

With the vuln being exploitable before authentication, anyone could send malformed requests to a target device – either causing a denial-of-service condition by crashing it, or potentially exploiting it to remotely execute code without local authentication; Tripwire says such an attack is "likely feasible." A worm could be developed that infects a machine via the VPN and then seeks out other vulnerable devices to hijack.

Affected versions are: SonicOS 6.5.4.6-79n and earlier, 6.5.1.11-4n and earlier, 6.0.5.3-93o and earlier, SonicOSv 6.5.4.4-44v-21-794 and earlier, and SonicOS 7.0.0.0-1. The security hole is closed in these newly released versions: SonicOS 6.5.4.7-83n, 6.5.1.12-1n, 6.0.5.3-94o, SonicOSv 6.5.4.v-21s-987, and SonicOS 7.0.0.0-2 and onwards.

In a statement SonicWall said it “was contacted by a third-party research team regarding issues related to SonicWall next-generation virtual firewall models (6.5.4v)." The spokesman went on to say that SonicWall’s own engineers discovered even more vulns while reproducing Tripwire’s findings, going on to develop patches for the whole lot.

“Immediately upon discovery, SonicWall researchers conducted extensive testing and code review to confirm the third-party research. This analysis lead to the discovery of additional unique vulnerabilities to virtual and hardware appliances requiring Common Vulnerabilities and Exposures (CVE) listings... The PSIRT team worked to duplicate the issues and develop, test and release patches for the affected products,” said the spokesman.

He concluded: “At this time, SonicWall is not aware of a vulnerability that has been exploited or that any customer has been impacted.” SonicWall credited Craig Young at Tripwire and Nikita Abramov at Positive Technologies for reporting the stack-overflow bug.

A batch of 11 patches have been released by SonicWall. Sysadmins are advised to check for updates and deploy these sooner rather than later. ®