Nicholas Newsom

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma Access customers.

An improper handling of exceptional conditions issue exists in the DNS proxy feature of Palo Alto Networks PAN-OS software. This allows a meddler-in-the-middle (MITM) to send specifically crafted traffic to the firewall, causing the service to restart unexpectedly. Repeated attempts to send this request result in denial-of-service to all PAN-OS services by restarting the device in maintenance mode. This issue does not impact Panorama appliances and Prisma Access customers.

A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication. This issue impacts Prisma Access customers with Prisma Access 2.1 Preferred firewalls.

The issue is related to improper handling of exceptional conditions in the dataplane of PAN-OS, allowing an unauthenticated network-based attacker to send specifically crafted traffic through the firewall, causing the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode.

An improper handling of exceptional conditions issue exists in Palo Alto Networks GlobalProtect portal and gateway interfaces, allowing an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface, causing the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. Prisma Access customers are not impacted by this issue.

An OS command injection and memory corruption issue in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code and OS commands with root privileges.

Name of the Vulnerable Software and Affected Versions: PAN-OS versions prior to 8.1.17 PAN-OS versions prior to 9.0.11 PAN-OS versions prior to 9.1.5 PAN-OS versions prior to 10.0.1 Description: An authentication bypass issue exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software, allowing an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to restricted VPN network resources when the gateway or portal is configured to rely entirely on certificate-based authentication. Impacted features include GlobalProtect Gateway, GlobalProtect Portal, and GlobalProtect Clientless VPN. In configurations where client certificate verification is used with other authentication methods, the protections added by the certificate check are ignored. Recommendations: For PAN-OS versions prior to 8.1.17, update to version 8.1.17 or later. For PAN-OS versions prior to 9.0.11, update to version 9.0.11 or later. For PAN-OS versions prior to 9.1.5, update to version 9.1.5 or later. For PAN-OS versions prior to 10.0.1, update to version 10.0.1 or later. As a temporary workaround, consider restricting access to the GlobalProtect SSL VPN component until a patch is available.

The issue is an OS Command Injection vulnerability in the PAN-OS management interface. It allows authenticated administrators to execute arbitrary OS commands with root privileges.

A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges.

The issue is caused by an insecure configuration of the appweb daemon, allowing a remote unauthenticated user to send a specifically crafted request to the device, causing the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode.

A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges.

The issue exists due to the lack of neutralization of special elements used in the operating system command. This allows an attacker to execute arbitrary operating system commands with root privileges when uploading a new certificate in FIPS-CC mode. The estimated number of potentially affected devices and details about real-world incidents are not provided.

A NULL pointer dereference issue allows an authenticated administrator to send a request that causes the rasmgr daemon to crash, resulting in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode.

An external control of filename vulnerability in the SD WAN component allows an authenticated administrator to send a request that results in the creation and write of an arbitrary file on all firewalls managed by the Panorama. In some cases, this results in arbitrary code execution with root permissions.

The issue is an OS command injection vulnerability in the PAN-OS management interface. This allows an authenticated administrator to execute arbitrary OS commands with root privileges. The vulnerability exists due to the lack of neutralization of special elements used in the OS command.

A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges.

A stack-based buffer overflow vulnerability in the management server component of PAN-OS allows an authenticated user to upload a corrupted PAN-OS configuration and potentially execute code with root privileges.

A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network-based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and escalating privileges.

The issue is related to memory corruption in the PAN-OS system, which can be caused by an administrative user rekeying the current client interactive session. This can lead to arbitrary memory corruption. The vulnerability is associated with a buffer overflow in memory, which can be exploited by a remote attacker to cause memory corruption or a denial of service.

The issue is caused by a memory corruption vulnerability that allows a remote, unauthenticated user to craft a message to Secure Shell Daemon (SSHD) and corrupt arbitrary memory. This can be achieved by exploiting a buffer overflow operation in memory. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.