Defense Digests

Unauthenticated Stack-based Buffer Overflow Vulnerability in SonicOS

Table of content

Dataprise Defense Digest

Severity: TBA

Published: March 3rd, 2023

EXECUTIVE SUMMARY

SonicWall has announced the discovery of a stack-based buffer overflow vulnerability in certain SonicOS firmware versions. This vulnerability may allow an attacker to send a malicious request to create a Denial of Service (DoS) attack that could crash an impacted firewall appliance. However, SonicWall has not received any reports of malicious use of this vulnerability. The impacted firmware versions are listed in a table provided by SonicWall, along with corresponding remediation steps. Organizations are advised to review the table and take appropriate mitigation steps to protect their networks from potential attacks.

Dataprise is aware of the critical nature of this vulnerability and has completed a review of all available analysis of these vulnerabilities and the potential impact to our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions. If your organization’s SonicWall appliance is covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on our mitigation efforts. Additionally, the Dataprise Cybersecurity team has implemented detection rules in our SIEM to identify any attempts to exploit any SonicWall appliances that are being monitored by our SOC under a Managed Security Services plan.

IMPACT

SonicWall has provided a table with a list of impacted platforms, versions, and fixed versions for each product. If an organization’s firewall appliance is using an impacted firmware version, they are advised to follow the provided patch guidance to fix the vulnerability. SonicWall has stated that physical firewall appliances using SonicOS 5.x, 6.x, and 6.5.x are not impacted.

Impacted Platforms	Impacted Version
TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSv 270, NSv 470, NSv 870	7.0.1-5095 and older
NSsp 15700	7.0.1-5083 and older
NSv 10, NSv 25, NSv 50, NSv 100, NSv 200, NSv 300, NSv 400, NSv 800, NSv 1600	6.5.4.4-44v-21-1

DETAILED ANALYSIS

The vulnerability is a stack-based buffer overflow, which occurs when an attacker sends a malicious request to the SonicWall firewall appliance. The vulnerability potentially allows an unauthenticated user to create a Denial of Service (DoS) attack that may cause the impacted firewall appliance to crash. SonicWall has not yet received any reports of malicious use of this vulnerability. However, the potential for a DoS attack can disrupt an organization’s network operations and cause significant downtime.

MITIGATION STEPS

Organizations can restrict management access of the firewall to only trusted sources by disabling management access and instead using VPN and/or Network Security Manager (NSM) for remote access and management. In addition, organizations should review the table provided by SonicWall to identify if their firewall appliance is impacted by the vulnerability. If so, the organization should follow the patch guidance below to fix the vulnerability.

Product	Impacted Platforms	Impacted Version	Fixed Version
SonicWall (Gen 7) Firewalls	TZ270 TZ270W, TZ370, TZ370W TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSv 270, NSv 470, NSv 870	7.0.1-5095 and earlier	7.0.1-5111 and later
SonicWall NSsp Firewall	NSsp 15700	7.0.1-5083 and earlier	7.0.1-5100 and later
SonicWall (Gen 6.5) NSv Firewalls	NSv 10, NSv 25, NSv 50, Nsv 100, NSv 200, NSv, 300, NSv 400, NSv 800, NSv 1600	6.5.4.4-44v-21-1551 and earlier