{"id":22510,"date":"2021-12-10T00:02:00","date_gmt":"2021-12-09T23:02:00","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=22510"},"modified":"2021-12-09T18:54:51","modified_gmt":"2021-12-09T17:54:51","slug":"kritische-schwachstellen-in-sonicwall-sma-100-patchen","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2021\/12\/10\/kritische-schwachstellen-in-sonicwall-sma-100-patchen\/","title":{"rendered":"Patch critical vulnerabilities in SonicWall SMA 100"},"content":{"rendered":"

\"Sicherheit[German<\/a>]SonicWall's Secure Mobile Access (SMA) 100-Series solution provides secure end-to-end remote access to enterprise resources hosted in on-premise, cloud and hybrid data centers. Vendor SonicWall is now urging users of its SMA 100 devices (SECURE MOBILE ACCESS 100-SERIES) to patch. Security researchers have found two critical vulnerabilities in the firmware, for which the manufacturer is providing security updates. <\/p>\n

<\/p>\n

\"\"In its December 9, 2021 Security Notice<\/a>,  the vendor announced that it has reviewed and patched critical and moderate severity vulnerabilities (CVSS 5.3-9.8) in the SMA 100-Series appliances, which include the SMA 200, 210, 400, 410 and 500v products. SMA 100-series appliances with WAF enabled are also affected by most of these vulnerabilities. The following vulnerabilities are listed on this web page<\/a>: <\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Issue ID<\/td>\nReporting Party<\/td>\nCVE<\/td>\nCVSS<\/td>\nSummary<\/td>\n<\/tr>\n
SMA-3217<\/td>\nRapid7<\/td>\nCVE-2021-20038<\/td>\n9.8<\/td>\nUnauthenticated Stack-Based Buffer Overflow<\/td>\n<\/tr>\n
SMA-3204<\/td>\nRapid7<\/td>\nCVE-2021-20039<\/td>\n7.2<\/td>\nAuthenticated Command Injection<\/td>\n<\/tr>\n
SMA-3206<\/td>\nRapid7 |NCCGroup<\/td>\nCVE-2021-20040<\/td>\n6.5<\/td>\nUnauthenticated File Upload Path Traversal<\/td>\n<\/tr>\n
SMA-3207<\/td>\nRapid7<\/td>\nCVE-2021-20041<\/td>\n7.5<\/td>\nUnauthenticated CPU Exhaustion<\/td>\n<\/tr>\n
SMA-3208<\/td>\nRapid7<\/td>\nCVE-2021-20042<\/td>\n6.3<\/td>\nUnauthenticated Confused Deputy<\/td>\n<\/tr>\n
SMA-3231<\/td>\nNCCGroup<\/td>\nCVE-2021-20043<\/td>\n8.8<\/td>\nHeap-Based Buffer Overflow<\/td>\n<\/tr>\n
SMA-3233<\/td>\nNCCGroup<\/td>\nCVE-2021-20044<\/td>\n7.2<\/td>\nPost-Authentication Remote Command Execution<\/td>\n<\/tr>\n
SMA-3235<\/td>\nNCCGroup<\/td>\nCVE-2021-20045<\/td>\n9.4<\/td>\nMultiple Unauthenticated Heap-Based and Stack Based Buffer Overflow<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical vulnerabilities CVE-2021-20038 (CVSS 9.8) and CVE-2021-20045 (CVSS 9.4) in the SMA 100 appliances could allow an unauthenticated attacker to cause a stack-based buffer overflow. The CVE-2021-20038 vulnerability is due to the Apache httpd server GET method of SonicWall SMA SSLVPN using a single stack-based buffer in the environment variables of the mod_cgi module using `strcat`. This allows remote attackers to perform a stack-based buffer overflow that would lead to code execution.<\/p>\n

Both vulnerabilities allow code execution in the SMA100 appliance as a nobody user. SMA 100 users with WAF enabled are also affected by this vulnerability. There is no evidence yet that the vulnerabilities listed in the table above are being exploited in the wild. SonicWall strongly recommends that organizations follow the instructions<\/a> to patch the SMA 100 series products. The linked page also lists the details of the remaining vulnerabilities from the table above. It should not be long before these vulnerabilities are exploited by cybercriminals.<\/p>\n","protected":false},"excerpt":{"rendered":"

[German]SonicWall's Secure Mobile Access (SMA) 100-Series solution provides secure end-to-end remote access to enterprise resources hosted in on-premise, cloud and hybrid data centers. Vendor SonicWall is now urging users of its SMA 100 devices (SECURE MOBILE ACCESS 100-SERIES) to patch. … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,22],"tags":[69,195],"class_list":["post-22510","post","type-post","status-publish","format-standard","hentry","category-security","category-update","tag-security","tag-update"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/22510","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=22510"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/22510\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=22510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=22510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=22510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}