Does the glibc library (CVE-2015-7547) vulnerability affects SRA devices?

03/26/2020 1045 10540

DESCRIPTION:
Does the glibc library (CVE-2015-7547) vulnerability affects SRA devices?

RESOLUTION:

Buffer overflow vulnerability in glibc library (CVE-2015-7547) currently affects versions equal and prior to 8.1.0.1-11sv for SRA 4600/1600/Virtual Appliance and 8.0.0.4-25sv for SRA 4200/1200.

You can find more information about this vulnerability in the following links:

https://support.sonicwall.com/product-notification/187642?productName=SonicWall%20SRA%20Series

https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7547

In order to fix this issue the firmware must be upgraded to the firmware version 8.1.0.2-14sv or higher for the SRA 4600/1600/Virtual Appliance and 8.0.0.5-27sv for the SRA 4200/1200.
You can download the firmware from the www.mysonicwall.com website.

In order to upgrade the firmware on the physical appliances (SRA 4600/1600/4200/1200), please follow the KB article: https://www.sonicwall.com/en-us/support/knowledge-base/170502339501169

For the SRA Virtual Appliance, upgrading the firmware using the .sig file does not resolve the issue. In this case you must deploy a new OVA file. The following the steps describe the procedure to deploy a new OVA file:

1. Export the settings from the old virtual appliance from “System” > “Settings” > “Export Settings…”.
2. Make a note of the serial number and authentication code of the old virtual appliance. You can find these on the “System” > “Status” page.
3. Power off the old virtual appliance. 
4. Deploy the new virtual appliance using the OVA file available from www.mysonicwall.com.
5. Power on the new virtual appliance and configure the X0 interface using the CLI. 
6. Log into the new virtual appliance with the default administrator credentials and import your saved configuration settings from "System" > "Settings" > "Import Settings".
7. In MySonicWall, click on the serial number of the old virtual appliance. On the Service Management page for it, click the "Delete" button to delete licensing for the old virtual appliance.
8. Register the new virtual appliance using the same serial number and authentication code of the old virtual appliance.