-------------------------- nsoadv-2010-005 ---------------------------

   sonicwall e-class ssl-vpn activex control format string overflow
______________________________________________________________________
______________________________________________________________________

                               111101111
                        11111 00110 00110001111
                   111111 01 01 1 11111011111111
                11111  0 11 01 0 11 1 1  111011001
             11111111101 1 11 0110111  1    1111101111
           1001  0 1 10 11 0 10 11 1111111  1 111 111001
         111111111 0 10 1111 0 11 11 111111111 1 1101 10
        00111 0 0 11 00 0 1110 1 1011111111111 1111111 11  100
       10111111 0 01 0  1 1 111110 11 1111111111111  11110000011
       0111111110 0110 1110 1 0 11101111111111111011 11100  00
       01111 0 10 1110 1 011111 1 111111111111111111111101 01
       01110 0 10 111110 110 0 11101111111111111111101111101
      111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111
      111110110 10 0111110 1 0 0 1111111111111111111111111 110
    111 11111 1  1 111 1   10011 101111111111011111111 0   1100
   111 10  110 101011110010   11111111111111111111111 11 0011100
   11 10     001100     0001      111111111111111111 10 11 11110
  11110       00100      00001     10 1  1111  101010001 11111111
  11101        0  1011     10000    00100 11100        00001101 0
  0110         111011011             0110   10001        101 11110
  1011                 1             10 101   000001        01   00
   1010 1                              11001      1 1        101  10
      110101011                          0 101                 11110
            110000011
                      111
______________________________________________________________________
______________________________________________________________________

  title:                  sonicwall e-class ssl-vpn activex control
                          format string overflow
  severity:               high
  advisory id:            nsoadv-2010-005
  found date:             22.02.2010
  date reported:          09.06.2010
  release date:           19.08.2010
  author:                 nikolas sotiriu
  website:               
  twitter:               
  mail:                   nso-research at sotiriu.de
  url:                   
  vendor:                 sonicwall ()
  affected products:      sonicwall sra ex1600
                          sonicwall ex7000
                          sonicwall ex6000
                          sonicwall ex-1600
                          sonicwall ex-1500
                          sonicwall ex-750
  affected versions:      10.0.4 and all previous versions
                          10.5.1 without hotfix
  remote exploitable:     yes
  local exploitable:      no
  patch status:           vendor released a patch
  discovered by:          nikolas sotiriu
  disclosure policy:     
  thanks to:              thierry zoller: for the permission to use his
                                          policy