Dataprise Defense Digest
Severity: TBA
Published: March 3rd, 2023
EXECUTIVE SUMMARY
SonicWall has announced the discovery of a stack-based buffer overflow vulnerability in certain SonicOS firmware versions. This vulnerability may allow an attacker to send a malicious request to create a Denial of Service (DoS) attack that could crash an impacted firewall appliance. However, SonicWall has not received any reports of malicious use of this vulnerability. The impacted firmware versions are listed in a table provided by SonicWall, along with corresponding remediation steps. Organizations are advised to review the table and take appropriate mitigation steps to protect their networks from potential attacks.
Dataprise is aware of the critical nature of this vulnerability and has completed a review of all available analysis of these vulnerabilities and the potential impact to our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions. If your organization’s SonicWall appliance is covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on our mitigation efforts. Additionally, the Dataprise Cybersecurity team has implemented detection rules in our SIEM to identify any attempts to exploit any SonicWall appliances that are being monitored by our SOC under a Managed Security Services plan.
IMPACT
SonicWall has provided a table with a list of impacted platforms, versions, and fixed versions for each product. If an organization’s firewall appliance is using an impacted firmware version, they are advised to follow the provided patch guidance to fix the vulnerability. SonicWall has stated that physical firewall appliances using SonicOS 5.x, 6.x, and 6.5.x are not impacted.
| Impacted Platforms | Impacted Version |
| TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSv 270, NSv 470, NSv 870 | 7.0.1-5095 and older |
| NSsp 15700 | 7.0.1-5083 and older |
| NSv 10, NSv 25, NSv 50, NSv 100, NSv 200, NSv 300, NSv 400, NSv 800, NSv 1600 | 6.5.4.4-44v-21-1 |
DETAILED ANALYSIS
The vulnerability is a stack-based buffer overflow, which occurs when an attacker sends a malicious request to the SonicWall firewall appliance. The vulnerability potentially allows an unauthenticated user to create a Denial of Service (DoS) attack that may cause the impacted firewall appliance to crash. SonicWall has not yet received any reports of malicious use of this vulnerability. However, the potential for a DoS attack can disrupt an organization’s network operations and cause significant downtime.
MITIGATION STEPS
Organizations can restrict management access of the firewall to only trusted sources by disabling management access and instead using VPN and/or Network Security Manager (NSM) for remote access and management. In addition, organizations should review the table provided by SonicWall to identify if their firewall appliance is impacted by the vulnerability. If so, the organization should follow the patch guidance below to fix the vulnerability.
| Product | Impacted Platforms | Impacted Version | Fixed Version |
SonicWall (Gen 7) Firewalls | TZ270 TZ270W, TZ370, TZ370W TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSv 270, NSv 470, NSv 870 | 7.0.1-5095 and earlier | 7.0.1-5111 and later |
| SonicWall NSsp Firewall | NSsp 15700 | 7.0.1-5083 and earlier | 7.0.1-5100 and later |
| SonicWall (Gen 6.5) NSv Firewalls | NSv 10, NSv 25, NSv 50, Nsv 100, NSv 200, NSv, 300, NSv 400, NSv 800, NSv 1600 | 6.5.4.4-44v-21-1551 and earlier |
SOURCES
CONTRIBUTING AUTHORS
- Dan Mervis, Cybersecurity Analyst
- Stephen Jones, VP Cybersecurity
