Unauthenticated Stack-based Buffer Overflow Vulnerability in SonicOS

Dataprise Defense Digest

Severity: TBA

Published: March 3rd, 2023

EXECUTIVE SUMMARY

SonicWall has announced the discovery of a stack-based buffer overflow vulnerability in certain SonicOS firmware versions. This vulnerability may allow an attacker to send a malicious request to create a Denial of Service (DoS) attack that could crash an impacted firewall appliance. However, SonicWall has not received any reports of malicious use of this vulnerability. The impacted firmware versions are listed in a table provided by SonicWall, along with corresponding remediation steps. Organizations are advised to review the table and take appropriate mitigation steps to protect their networks from potential attacks.

Dataprise is aware of the critical nature of this vulnerability and has completed a review of all available analysis of these vulnerabilities and the potential impact to our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions. If your organization’s SonicWall appliance is covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on our mitigation efforts. Additionally, the Dataprise Cybersecurity team has implemented detection rules in our SIEM to identify any attempts to exploit any SonicWall appliances that are being monitored by our SOC under a Managed Security Services plan.

IMPACT

SonicWall has provided a table with a list of impacted platforms, versions, and fixed versions for each product. If an organization’s firewall appliance is using an impacted firmware version, they are advised to follow the provided patch guidance to fix the vulnerability. SonicWall has stated that physical firewall appliances using SonicOS 5.x, 6.x, and 6.5.x are not impacted.

DETAILED ANALYSIS

The vulnerability is a stack-based buffer overflow, which occurs when an attacker sends a malicious request to the SonicWall firewall appliance. The vulnerability potentially allows an unauthenticated user to create a Denial of Service (DoS) attack that may cause the impacted firewall appliance to crash. SonicWall has not yet received any reports of malicious use of this vulnerability. However, the potential for a DoS attack can disrupt an organization’s network operations and cause significant downtime.

MITIGATION STEPS

Organizations can restrict management access of the firewall to only trusted sources by disabling management access and instead using VPN and/or Network Security Manager (NSM) for remote access and management. In addition, organizations should review the table provided by SonicWall to identify if their firewall appliance is impacted by the vulnerability. If so, the organization should follow the patch guidance below to fix the vulnerability.

SOURCES

• https://www.sonicwall.com/support/knowledge-base/product-notice-unauthenticated-stack-based-buffer-overflow-vulnerability-in-sonicos/230215102147553/
• https://nvd.nist.gov/vuln/detail/CVE-2023-0656

CONTRIBUTING AUTHORS

• Dan Mervis, Cybersecurity Analyst
• Stephen Jones, VP Cybersecurity