TUCoPS :: Network Appliances

TUCoPS :: Network Appliances :: va1698.htm
SonicWALL Content-Filtering Universal Script Injection Vulnerability
ZDI-08-070: SonicWALL Content-Filtering Universal Script Injection Vulnerability ZDI-08-070: SonicWALL Content-Filtering Universal Script Injection Vulnerability

WkRJLTA4LTA3MDogU29uaWNXQUxMIENvbnRlbnQtRmlsdGVyaW5nIFVuaXZlcnNhbCBTY3JpcHQg
SW5qZWN0aW9uIA0KVnVsbmVyYWJpbGl0eQ0KaHR0cDovL3d3dy56ZXJvZGF5aW5pdGlhdGl2ZS5j
b20vYWR2aXNvcmllcy9aREktMDgtMDcwDQpPY3RvYmVyIDMwLCAyMDA4DQoNCi0tIEFmZmVjdGVk
IFZlbmRvcnM6DQpTb25pY1dBTEwNCg0KLS0gQWZmZWN0ZWQgUHJvZHVjdHM6DQpTb25pY1dBTEwg
UHJvIDIwNDANCg0KLS0gVGlwcGluZ1BvaW50KFRNKSBJUFMgQ3VzdG9tZXIgUHJvdGVjdGlvbjoN
ClRpcHBpbmdQb2ludCBJUFMgY3VzdG9tZXJzIGhhdmUgYmVlbiBwcm90ZWN0ZWQgYWdhaW5zdCB0
aGlzDQp2dWxuZXJhYmlsaXR5IGJ5IERpZ2l0YWwgVmFjY2luZSBwcm90ZWN0aW9uIGZpbHRlciBJ
RCAyMDIzLCAzODg2LiANCkZvciBmdXJ0aGVyIHByb2R1Y3QgaW5mb3JtYXRpb24gb24gdGhlIFRp
cHBpbmdQb2ludCBJUFMsIHZpc2l0Og0KDQogICAgaHR0cDovL3d3dy50aXBwaW5ncG9pbnQuY29t
DQoNCi0tIFZ1bG5lcmFiaWxpdHkgRGV0YWlsczoNClRoaXMgdnVsbmVyYWJpbGl0eSBhbGxvd3Mg
cmVtb3RlIGF0dGFja2VycyB0byBleGVjdXRlIGEgc2NyaXB0IGluamVjdGlvbg0KYXR0YWNrIG9u
IGFyYml0cmFyeSBzaXRlcyB0aHJvdWdoIHZ1bG5lcmFibGUgaW5zdGFsbGF0aW9ucyBvZiBTb25p
Y1dBTEwuDQpVc2VyIGludGVyYWN0aW9uIGlzIHJlcXVpcmVkIHRvIGV4cGxvaXQgdGhpcyB2dWxu
ZXJhYmlsaXR5IGluIHRoYXQgdGhlDQp0YXJnZXQgbXVzdCB2aXNpdCBhIG1hbGljaW91cyB3ZWIg
cGFnZSBvciBvcGVuIGEgbWFsaWNpb3VzIHdlYiBsaW5rLg0KDQpUaGUgc3BlY2lmaWMgZmxhdyBl
eGlzdHMgaW4gdGhlIGRlZmF1bHQgZXJyb3IgcGFnZSBkaXNwbGF5ZWQgd2hlbiBhIHVzZXINCnJl
cXVlc3RzIGFjY2VzcyB0byBhIHdlYiBzaXRlIHRoYXQgaXMgYmxvY2tlZCBiYXNlZCBvbiB0aGUg
ZGV2aWNlcw0KY29udGVudC1maWx0ZXJpbmcgcnVsZXMuIEluc3VmZmljaWVudCBzYW5pdHkgY2hl
Y2tzIGFsbG93IGFuIGF0dGFja2VyIHRvDQpjcmFmdCBhIFVSTCB0aGF0IHdpbGwgdHJpZ2dlciBh
biBlcnJvciBhbmQgc2ltdWx0YW5lb3VzbHkgaW5qZWN0IGENCm1hbGljaW91cyBzY3JpcHQuIEFz
IHRoZSBicm93c2VyIGlzIHVuYWJsZSB0byBkaWZmZXJlbnRpYXRlIGJldHdlZW4NCmNvbnRlbnQg
ZGVsaXZlcmVkIGZyb20gdGhlIG9yaWdpbmFsIHRvcCBsZXZlbCBzaXRlIHJlcXVlc3RlZCBhbmQg
dGhlDQppbmxpbmUgZGV2aWNlLCB0aGUgc2NyaXB0IGluamVjdGlvbiBvY2N1cnMgdW5kZXIgdGhl
IGNvbnRleHQgb2YgdGhlDQp0YXJnZXQgZG9tYWluLiBUaGlzIGNhbiByZXN1bHQgaW4gdmFyaW91
cyBmdXJ0aGVyIGNvbXByb21pc2UuDQoNCi0tIFZlbmRvciBSZXNwb25zZToNClNvbmljV0FMTCBo
YXMgaXNzdWVkIGFuIHVwZGF0ZSB0byBjb3JyZWN0IHRoaXMgdnVsbmVyYWJpbGl0eS4gTW9yZQ0K
ZGV0YWlscyBjYW4gYmUgZm91bmQgYXQ6DQoNCmh0dHA6Ly93d3cuc29uaWN3YWxsLmNvbS9kb3du
bG9hZHMvU29uaWNPU19FbmhhbmNlZF80LjAuMS4xX1JlbGVhc2VfTm90ZXMucGRmDQoNCi0tIERp
c2Nsb3N1cmUgVGltZWxpbmU6DQoyMDA4LTA2LTI1IC0gVnVsbmVyYWJpbGl0eSByZXBvcnRlZCB0
byB2ZW5kb3INCjIwMDgtMTAtMzAgLSBDb29yZGluYXRlZCBwdWJsaWMgcmVsZWFzZSBvZiBhZHZp
c29yeQ0KDQotLSBDcmVkaXQ6DQpUaGlzIHZ1bG5lcmFiaWxpdHkgd2FzIGRpc2NvdmVyZWQgYnk6
DQogICAgKiBBZHJpYW4gJ3BhZ3ZhYycgUGFzdG9yIHwgR05VQ0lUSVpFTiB8IHd3dy5nbnVjaXRp
emVuLm9yZyANCg0KLS0gQWJvdXQgdGhlIFplcm8gRGF5IEluaXRpYXRpdmUgKFpESSk6DQpFc3Rh
Ymxpc2hlZCBieSBUaXBwaW5nUG9pbnQsIFRoZSBaZXJvIERheSBJbml0aWF0aXZlIChaREkpIHJl
cHJlc2VudHMgDQphIGJlc3Qtb2YtYnJlZWQgbW9kZWwgZm9yIHJld2FyZGluZyBzZWN1cml0eSBy
ZXNlYXJjaGVycyBmb3IgcmVzcG9uc2libHkNCmRpc2Nsb3NpbmcgZGlzY292ZXJlZCB2dWxuZXJh
YmlsaXRpZXMuDQoNClJlc2VhcmNoZXJzIGludGVyZXN0ZWQgaW4gZ2V0dGluZyBwYWlkIGZvciB0
aGVpciBzZWN1cml0eSByZXNlYXJjaA0KdGhyb3VnaCB0aGUgWkRJIGNhbiBmaW5kIG1vcmUgaW5m
b3JtYXRpb24gYW5kIHNpZ24tdXAgYXQ6DQoNCiAgICBodHRwOi8vd3d3Lnplcm9kYXlpbml0aWF0
aXZlLmNvbQ0KDQpUaGUgWkRJIGlzIHVuaXF1ZSBpbiBob3cgdGhlIGFjcXVpcmVkIHZ1bG5lcmFi
aWxpdHkgaW5mb3JtYXRpb24gaXMNCnVzZWQuIFRpcHBpbmdQb2ludCBkb2VzIG5vdCByZS1zZWxs
IHRoZSB2dWxuZXJhYmlsaXR5IGRldGFpbHMgb3IgYW55DQpleHBsb2l0IGNvZGUuIEluc3RlYWQs
IHVwb24gbm90aWZ5aW5nIHRoZSBhZmZlY3RlZCBwcm9kdWN0IHZlbmRvciwNClRpcHBpbmdQb2lu
dCBwcm92aWRlcyBpdHMgY3VzdG9tZXJzIHdpdGggemVybyBkYXkgcHJvdGVjdGlvbiB0aHJvdWdo
DQppdHMgaW50cnVzaW9uIHByZXZlbnRpb24gdGVjaG5vbG9neS4gRXhwbGljaXQgZGV0YWlscyBy
ZWdhcmRpbmcgdGhlDQpzcGVjaWZpY3Mgb2YgdGhlIHZ1bG5lcmFiaWxpdHkgYXJlIG5vdCBleHBv
c2VkIHRvIGFueSBwYXJ0aWVzIHVudGlsDQphbiBvZmZpY2lhbCB2ZW5kb3IgcGF0Y2ggaXMgcHVi
bGljbHkgYXZhaWxhYmxlLiBGdXJ0aGVybW9yZSwgd2l0aCB0aGUNCmFsdHJ1aXN0aWMgYWltIG9m
IGhlbHBpbmcgdG8gc2VjdXJlIGEgYnJvYWRlciB1c2VyIGJhc2UsIFRpcHBpbmdQb2ludA0KcHJv
dmlkZXMgdGhpcyB2dWxuZXJhYmlsaXR5IGluZm9ybWF0aW9uIGNvbmZpZGVudGlhbGx5IHRvIHNl
Y3VyaXR5DQp2ZW5kb3JzIChpbmNsdWRpbmcgY29tcGV0aXRvcnMpIHdobyBoYXZlIGEgdnVsbmVy
YWJpbGl0eSBwcm90ZWN0aW9uIG9yDQptaXRpZ2F0aW9uIHByb2R1Y3QuDQoNCk91ciB2dWxuZXJh
YmlsaXR5IGRpc2Nsb3N1cmUgcG9saWN5IGlzIGF2YWlsYWJsZSBvbmxpbmUgYXQ6DQoNCiAgICBo
dHRwOi8vd3d3Lnplcm9kYXlpbml0aWF0aXZlLmNvbS9hZHZpc29yaWVzL2Rpc2Nsb3N1cmVfcG9s
aWN5Lw0KDQpDT05GSURFTlRJQUxJVFkgTk9USUNFOiBUaGlzIGUtbWFpbCBtZXNzYWdlLCBpbmNs
dWRpbmcgYW55IGF0dGFjaG1lbnRzLA0KaXMgYmVpbmcgc2VudCBieSAzQ29tIGZvciB0aGUgc29s
ZSB1c2Ugb2YgdGhlIGludGVuZGVkIHJlY2lwaWVudChzKSBhbmQNCm1heSBjb250YWluIGNvbmZp
ZGVudGlhbCwgcHJvcHJpZXRhcnkgYW5kL29yIHByaXZpbGVnZWQgaW5mb3JtYXRpb24uDQpBbnkg
dW5hdXRob3JpemVkIHJldmlldywgdXNlLCBkaXNjbG9zdXJlIGFuZC9vciBkaXN0cmlidXRpb24g
YnkgYW55IA0KcmVjaXBpZW50IGlzIHByb2hpYml0ZWQuICBJZiB5b3UgYXJlIG5vdCB0aGUgaW50
ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2UNCmRlbGV0ZSBhbmQvb3IgZGVzdHJveSBhbGwgY29waWVz
IG9mIHRoaXMgbWVzc2FnZSByZWdhcmRsZXNzIG9mIGZvcm0gYW5kDQphbnkgaW5jbHVkZWQgYXR0
YWNobWVudHMgYW5kIG5vdGlmeSAzQ29tIGltbWVkaWF0ZWx5IGJ5IGNvbnRhY3RpbmcgdGhlDQpz
ZW5kZXIgdmlhIHJlcGx5IGUtbWFpbCBvciBmb3J3YXJkaW5nIHRvIDNDb20gYXQgcG9zdG1hc3Rl
ckAzY29tLmNvbS4gDQo