bugtraq - SonicWall VPN/Firewall Appliance - DoS, ARP Flood, Network mapping vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon,  1 Mar 2004 23:04:24 -0800
From: <xeno@...h.ai>
To: bugtraq@...urityfocus.com
Subject: SonicWall VPN/Firewall Appliance - DoS, ARP Flood, Network mapping vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SonicWall Firewall/VPN Appliance

www.sonicwall.com

Product History:

SonicWALL's family of Internet security appliances provide the first
line of defense against Internet security threats. They include an ICSA-
certified, stateful packet inspection firewall, IPSec VPN for remote
access, IP address management features, and support for SonicWALL value-
added security services.

Vulnerability: DoS, ARP Flood, Network mapping

Date of discovery: January 26th, 2004

Reported to SonicWall: January 27th, 2004

Confirmed by SonicWall: February 16th, 2004

Release date: March 1st, 2004

Product: SonicWall Firewall/VPN Appliance

Tested vulnerable Firmware Revisions:

6.5.0.4
6.5.0.3
6.4.0.2
6.4.0.1
6.3.1.4
6.3.1.0
6.2.0.0

Tested but Not vulnerable:

Sonic OS 2.0 and above

Firmware patch:  Available. Customers must call SonicWall tech support
for more details

Technical details:

Problem #1:
When the device encounters an ARP request on its External (WAN) interface
the SonicWall will check its Internal interface (LAN) ARP Cache to see
if knows about the requested IP. Upon finding the requested IP in its
ARP Cache the Sonic Wall will respond with an ARP reply on behalf of
the IP being ARPed.

Problem #2
If the Sonic Wall does not find the IP in its ARP Cache
and the IP being ARPed is part of a network that is attached to the LAN
interface of the Sonic Wall, it will proxy the ARP request from the WAN
interface through to the LAN interface.

Problem #3
For each single ARP request that the Sonic Wall proxies from the WAN
interface it will make 3 ARP broadcast requests on the LAN side, effectively
amplifying each WAN received request at a 3:1 ratio.

Misc information:

The ARP cache of a Sonic Wall running one of the above firmwares has
a 20 minute life time.
This bypasses all rule sets on the firewall.
There is no logging of Successful ARP requests or replies, so this type
of IP enumeration can go unnoticed.
If the SonicWall does not have the requested IP in its ARP cache and
the IP is not alive on the LAN side of the firewall there will be an
entry in the LOG stating that there was an ARP timeout with a source
IP of 0.0.0.0 and a destination IP of the IP requested.

-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.3

wkYEARECAAYFAkBEMtIACgkQsJZ5tw66F035IgCcDOMvtzxvzLxVR0vs0b7Cw5g/2EgA
n3GcT46eVdyhpMgjHwSvpmtlUijp
=1RFE
-----END PGP SIGNATURE-----

Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427