Dell SonicWall NetExtender Unquoted Autorun Privilege Escalation

[ajs@xxxxxxxxxxxxxxx]

Dell SonicWall NetExtender Unquoted Autorun Privilege Escalation

Vendor Website : http://www.sonicwall.com

INDEX
---------------------------------------
    1. CVE
    2. Background
    3. Description
    4. Affected Products
    5. Solution
    6. Credit
    7. Disclosure Timeline

1. CVE
---------------------------------------
    CVE: 2015-4173


2. BACKGROUND
---------------------------------------
    SonicWALL NetExtender is a transparent software application for users that 
enables remote users to securely connect to the remote network. With 
NetExtender, remote users can securely run any application on the remote 
network. Users can upload and download files, mount network drives, and access 
resources in the same way as if they were on the local network. The NetExtender 
connection uses a Point-to-Point Protocol (PPP) connection


3. DESCRIPTION
---------------------------------------
    Upon installation of the product on the Windows operating system, an 
autorun value is created that does not put the path in quotes. Placement of a 
malicious binary by a potential attacker within the parent path could allow 
privileged code execution upon administrative login.


4. AFFECTED PRODUCTS
---------------------------------------
    Dell SonicWall NetExtender 7.5.215


5. SOLUTION
---------------------------------------
    Upgrade to firmware version 7.5.1.2 or 8.0.0.3.


6. CREDIT
---------------------------------------
    This vulnerability was discovered by Andrew Smith of Sword & Shield 
Enterprise Security.


7. DISCLOSURE TIMELINE
---------------------------------------
    5-24-2015 - Vulnerability Discovered/Vendor Informed
    5-28-2015 - Vendor Confirmed Report/Vendor Gives Fix Timeline
    5-29-2015 - CVE Requested
    8-14-2015 - Fix Released and Public Disclosure by Vendor