PT-2017-18096 · Watchguard · Watchguard Fireware

Published 2017-04-22 · Updated 2017-04-27 · CVE-2017-8056

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware versions prior to v11.12.2

Description The issue is related to the mishandling of XML External Entity (XXE) requests in the XML-RPC agent, which can cause the Firebox wgagent process to crash. This results in the termination of all authenticated sessions, including management connections, and prevents new authenticated sessions until the process recovers. The Firebox may also experience performance degradation during the recovery of the wgagent process. An attacker can exploit this to perform a limited Denial of Service (DoS) attack by continuously sending XML-RPC requests with external entity references.

Recommendations For WatchGuard Fireware versions prior to v11.12.2, update to version v11.12.2 or later to resolve the issue.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-8056

Affected Products

Watchguard Fireware

References · 6

• 🔥 https://packetstormsecurity.com/files/142177/watchguardfbxtm-xxeinject.txt · Exploit
• 🔥 https://sidertia.com/Home/Community/Blog/2017/04/17/Fixed-the-Fireware-Vulnerabilities-discovered-by-Sidertia · Exploit
• https://watchguard.com/support/release-notes/fireware/11/en-US/EN_ReleaseNotes_Fireware_11_12_2/index.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8056 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8056 · Vendor Advisory
• http://watchguardsupport.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000KlBSAU · Vendor Advisory