Stormshield Network Security

CVSS v3.1 Overall Score: 3.1      

Analysis

Impacted version

The vulnerabilities identified here are of the following types:
– Incorrect neutralization of special elements used in a command (‘Command Injection’)
– Out-of-bounds writing
– Incorrect control of code generation (‘Code Injection’)
– Stack-based buffer overflow

By default, SN6100 is not impacted as the default BIOS configuration applied to SNS products does not offer the possibility of exploiting these various vulnerabilities. Only SN6100 appliances with IPMI revision <1.86 enabled are vulnerable.

It’s possible to check the IPMI firmware revision on SN6100 appliances using the following command in SNS shell:
> ipmitool mc info

Only IPMI firmware lower than 1.86 is impacted by these vulnerabilities.

Technical notes about the IPMI firmware update are available on the Stormshield documentation website.

To enforce Stormshield products security, we recommend to follow the RECOMMENDATIONS FOR THE SECURE CONFIGURATION OF AN SNS FIREWALL.

• SN6100 IPMI firmware lower than 1.86

Workaround solution

Solution

If enabled, disabling IPMI in the product’s BIOS settings can effectively prevent exploitation of this vulnerability.

The 1.86 IPMI update available on the Stormshield website (in TOOLS section) will fix these vulnerabilities.