Yamata Li

Name of the Vulnerable Software and Affected Versions: PAN-OS versions 8.0 PAN-OS 8.1 versions earlier than 8.1.15 PAN-OS 9.0 versions earlier than 9.0.9 PAN-OS 9.1 versions earlier than 9.1.3 Description: A buffer overflow vulnerability in PAN-OS is related to the lack of size checking for input data. This issue can be exploited by an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the "Captive Portal" or "Multi-Factor Authentication" interface. Recommendations: For PAN-OS version 8.0, update to a version later than 8.0. For PAN-OS 8.1 versions earlier than 8.1.15, update to version 8.1.15 or later. For PAN-OS 9.0 versions earlier than 9.0.9, update to version 9.0.9 or later. For PAN-OS 9.1 versions earlier than 9.1.3, update to version 9.1.3 or later.

An information exposure through log file vulnerability may occur where an administrator's password or other sensitive information is logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file, which tracks operational command usage, did not mask all sensitive information. This issue is resolved in PAN-OS 9.1 and later versions, where the opcmdhistory.log file is removed and command usage is recorded in the req stats.log file instead.

An OS Command Injection issue in the GlobalProtect portal allows an unauthenticated network-based attacker to execute arbitrary OS commands with root privileges. The attacker requires some knowledge of the firewall or may perform brute-force attacks to exploit this issue. This issue cannot be exploited if the GlobalProtect portal feature is not enabled. Palo Alto Networks is not aware of any malicious attempts to exploit this issue.

A buffer overflow issue exists in the way Microsoft Office handles CGM image files, allowing remote attackers to execute arbitrary code via a crafted CGM image in an Office document. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights.

The issue is related to an integer overflow in the PICT image converter, allowing remote attackers to execute arbitrary code via a crafted PICT image in an Office document. A remote code execution vulnerability exists in the way that Microsoft Office allocates buffer size when handling PICT image files. If a user opens an Office document containing a specially crafted PICT image, an attacker could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

A remote code execution issue exists in the way Microsoft MPEG Layer-3 codecs handle AVI media files. This could allow remote code execution if a user opens a specially crafted AVI file containing an MPEG Layer-3 audio stream. If a user is logged on with administrative user rights, an attacker who successfully exploits this issue could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users operating with administrative user rights.

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions 7.0 through 9.0c Description: The issue arises from the QuickTime Movie Parser Filter in quartz.dll, which fails to properly validate size fields in QuickTime media files. This allows remote attackers to execute arbitrary code via a crafted file. Recommendations: For Microsoft DirectX versions 7.0 through 9.0c, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the QuickTime Movie Parser Filter in DirectShow to minimize the risk of arbitrary code execution.

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions 7.0 through 9.0c Description: The issue concerns the QuickTime Movie Parser Filter in quartz.dll, which is part of DirectShow in Microsoft DirectX. It allows remote attackers to execute arbitrary code via a crafted QuickTime media file due to improper validation of unspecified data values when updating pointers. Recommendations: For Microsoft DirectX versions 7.0 through 9.0c, consider restricting the use of the QuickTime Movie Parser Filter until a patch is available. As a temporary workaround, avoid using the affected filter to parse QuickTime media files.

The issue concerns the WebDAV extension in Microsoft Internet Information Services (IIS) 5.0, which fails to properly decode URLs. This allows remote attackers to bypass authentication and potentially read or create files by sending a crafted HTTP request.

Name of the Vulnerable Software and Affected Versions: Microsoft Agent version 2.0.0.3425 Description: A stack-based buffer overflow issue exists in the way Microsoft Agent handles certain specially crafted URLs, allowing remote attackers to execute arbitrary code. This issue is triggered via a crafted URL to the Agent (Agent.Control) ActiveX control, leading to an overflow within the Agent Service (agentsrv.exe) process. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights. Recommendations: For Microsoft Agent version 2.0.0.3425, consider restricting access to the Agent Service (agentsrv.exe) process until a patch is available. As a temporary workaround, avoid using the Agent (Agent.Control) ActiveX control with crafted URLs.