CyberWire Daily

A firewall wake up call. [Research Saturday]

Nov 9, 2024

Jon Williams, a Senior Security Engineer at Bishop Fox, reveals alarming vulnerabilities in SonicWall firewalls that affect over 178,000 devices. He delves into his research on unauthenticated denial-of-service bugs, emphasizing the critical flaws in implementation. Williams explains how 76% of scanned firewalls with open management interfaces are vulnerable and provides insights on navigating vulnerability assessments without disrupting services. This discussion underscores the urgent need for enhanced security measures to protect against potential exploits.

23:01

Creator website

Episode guests

Jon Williams

AI Summary

AI Chapters

Episode notes

Podcast summary created with Snipd AI

Quick takeaways

The research reveals over 178,000 SonicWall firewalls are vulnerable due to unauthenticated denial-of-service vulnerabilities exposed over different HTTP paths.

Emphasizing the importance of rigorous code analysis, the study highlights a flawed implementation of the snprintf function leading to potential security threats.

Deep dives

Understanding SonicWall Vulnerabilities

The discussion highlights the vulnerabilities found in the SonicWall Next Generation Firewall Platform, specifically in SonicOS. Researcher John Williams examined previous advisories for unauthenticated vulnerabilities that could lead to remote code execution. By identifying a bug from 2022 that met these criteria, they began exploring its exploitability. The research underscores the need for awareness and preparedness in addressing potential security threats within sonic wall environments.

Intro

2min

Uncovering SonicWall Vulnerabilities

8min

Navigating Vulnerability Assessment Without Disruption

5min

Vulnerabilities in Internet-Connected Firewalls

5min

Navigating Firewall Vulnerabilities and Compliance Solutions

2min

Enjoy this special encore episode, where we are joined by Jon Williams from Bishop Fox, as he is sharing their research on "It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable." SonicWall published advisories for CVE-2022-22274 and CVE-2023-0656 a year apart after finding that NGFW series 6 and 7 devices are affected by two unauthenticated denial-of-service vulnerabilities.

The research states "Our research found that the two issues are fundamentally the same but exploitable at different HTTP URI paths due to reuse of a vulnerable code pattern." They also found that when they scanned SonicWall firewalls with management interfaces exposed to the internet, they found that 76% are vulnerable to one or both issues.

The research can be found here: