PT-2007-6778

CVE-2007-5814

Published

2007-11-05

Updated

2018-10-15

Description by

CVSS 2.0

9.3

High

MetricsAV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SonicWall SSL-VPN NetExtender versions prior to 2.1.0.51 SonicWall SSL-VPN NetExtender versions 2.5.x prior to 2.5.0.56

Description The issue allows remote attackers to execute arbitrary code via a long Unicode property value in several parameters, including serverAddress, sessionId, clientIPLower, clientIPHigher, userName, domainName, or dnsSuffix.

Recommendations For versions prior to 2.1.0.51, update to version 2.1.0.51 or later. For versions 2.5.x prior to 2.5.0.56, update to version 2.5.0.56 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Bernhard Mueller

Lofi42

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Related identifiers