SonicWALL Aventail epi.dll AuthCredential Format String

This module exploits a format string vulnerability within version 10.0.4.x and
10.5.1 of the SonicWALL Aventail SSL-VPN Endpoint Interrogator/Installer ActiveX
control (epi.dll). By calling the 'AuthCredential' method with a specially
crafted Unicode format string, an attacker can cause memory corruption and
execute arbitrary code.

Unfortunately, it does not appear to be possible to indirectly re-use existing
stack data for more reliable exploitation. This is due to several particulars
about this vulnerability. First, the format string must be a Unicode string,
which uses two bytes per character. Second, the buffer is allocated on the
stack using the 'alloca' function. As such, each additional format specifier (%x)
will add four more bytes to the size allocated. This results in the inability to
move the read pointer outside of the buffer.

Further testing showed that using specifiers that pop more than four bytes does
not help. Any number of format specifiers will result in accessing the same value
within the buffer.

NOTE: It may be possible to leverage the vulnerability to leak memory contents.
However, that has not been fully investigated at this time.

Nikolas Sotiriu
jduck jduck@metasploit.com

Windows