Fixed critical bug in SonicWall patches, updated quickly! (CVE-2020-5135)

Earlier this week SonicWall fixed 11 vulnerabilities that affect the Network Security Appliance (NSA). These include CVE-2020-5135, a critical stack-based buffer overflow vulnerability in the appliances VPN portal that could be exploited to cause denial of service and potentially remote code execution.

Via CVE-2020-5135

The SonicWall NSAs are next-generation firewall appliances with a sandbox, intrusion prevention system, SSL / TLS decryption and inspection functions, network-based malware protection and VPN functions.

CVE-2020-5135 was discovered by Nikita Abramov of Positive Technologies and Craig Young of the Tripwire Vulnerability and Exposures Research Team (VERT) and has the following effects:

• SonicOS 6.5.4.7-79n and earlier
• SonicOS 6.5.1.11-4n and earlier
• SonicOS 6.0.5.3-93o and earlier
• SonicOSv 6.5.4.4-44v-21-794 and earlier
• SonicOS 7.0.0.0-1

“The error can be triggered by an unauthenticated HTTP request that involves a custom protocol handler. The vulnerability exists within the HTTP / HTTPS service used for product management as well as remote SSL VPN access, ”Tripwire explained to VERT.

“This error occurs prior to authentication and within a component (SSLVPN) that is normally exposed to the public Internet.”

With the help of Shodan, both Tripwire and Tenable researchers discovered nearly 800,000 SonicWall NSA devices with the affected HTTP server banner on the Internet. However, as the latter noted, it is impossible to determine the actual number of vulnerable devices because their respective versions could not be determined (i.e. some may already have been patched).

A persistent DoS condition is apparently easy for attackers to achieve as it does not require prior authentication and can be triggered by sending a specially crafted request to the vulnerable service / SSL VPN portal.

According to VERT, a code execution exploit is “probably doable,” although it is a little more difficult to execute.

Mitigation and remediation

There is currently no evidence that the bug is being actively exploited, nor is there a public PoC exploitation code available, so administrators have the option to update affected devices.

Aside from implementing the update offered, they can alternatively disconnect the SSL VPN portal from the internet, although this action does not reduce the risk of exploiting some of the other bugs fixed by the latest updates.

Implementing the security updates is therefore the preferred step, especially since security flaws in SSL VPN solutions are often attacked by cyber criminals and threat actors.