Ben Nott

A buffer overflow vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Cloud NGFW and Panorama are not affected by this vulnerability.

A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption. Panorama and Prisma® Access are not affected by this vulnerability.

A stack-based buffer overflow in the log processing functionality allows an attacker to cause a denial of service (DoS) condition. Repeatedly triggering this issue causes the system to enter maintenance mode. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer can hold, potentially overwriting adjacent memory.

An improper input handling issue in the GlobalProtect gateway allows an authenticated user to establish a session by impersonating the identity of another user.

An unauthenticated attacker with network access can cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition cause the firewall to enter maintenance mode. Approximately 22,600 instances are identified globally. Cloud NGFW and Panorama are not affected.

An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the CLI to execute arbitrary OS commands to escalate privileges.

An information exposure issue exists in the Palo Alto Networks Panorama software, revealing the session token of the Panorama web interface administrator to a managed device when the administrator performs a context switch. This allows an attacker to gain privileged access to the Panorama web interface. The attacker requires some knowledge of managed firewalls to exploit this issue.

Name of the Vulnerable Software and Affected Versions: PAN-OS versions earlier than 8.1.16 PAN-OS versions earlier than 9.0.9 Description: A reflected cross-site scripting (XSS) issue exists in the PAN-OS management web interface. This could allow a remote attacker to execute arbitrary JavaScript code in an administrator's browser and perform administrative actions if the administrator clicks on a crafted link. The issue is related to insufficient input validation. Recommendations: For PAN-OS versions earlier than 8.1.16, update to version 8.1.16 or later. For PAN-OS versions earlier than 9.0.9, update to version 9.0.9 or later.

The issue is related to an authentication bypass vulnerability in the Panorama context switching feature, which can allow an attacker with network access to a Panorama's management interface to gain privileged access to managed firewalls. The attacker requires some knowledge of managed firewalls to exploit this issue. This issue does not affect Panorama configured with custom certificates authentication for communication between Panorama and managed devices.

A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This issue can be leveraged to obfuscate an ongoing attack or fabricate log entries in the ms.log file.

An external control of path and data issue in the Palo Alto Networks PAN-OS Panorama XSLT processing logic allows an unauthenticated user with network access to the PAN-OS management interface to write attacker-supplied files on the system and elevate privileges.

An improper input validation issue in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows a remote unauthenticated user to send a specifically crafted registration request to the device, causing the configuration service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS Panorama services by restarting the device and putting it into maintenance mode.

A cleartext transmission of sensitive information issue in Palo Alto Networks PAN-OS Panorama discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama version, their PAN-OS session cookie is transmitted over cleartext to the firewall. An attacker with the ability to intercept this network traffic between the firewall and Panorama can access the administrator's account and further manipulate devices managed by Panorama.

An OS Command Injection issue in the PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges.

The issue is related to an improper restriction of XML external entity reference ('XXE') vulnerability in the Palo Alto Networks Panorama management service. This allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system.

The issue allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin in the Project Wiki component. This occurs because the proc open PHP function is used with a syntax value in its first argument, which can be controlled by an authenticated Tuleap user, including shell metacharacters. For example, a line like '<?plugin SyntaxHighlighter syntax=`c;id`>' can be used to execute the id command.

An issue was discovered in the `findChildrenByFilter()` function, which is called by the web-accessible path `/categoriesServlet`. This function performs string interpolation and direct SQL query execution. Although SQL quote escaping and a keyword blacklist were implemented as part of a remediation effort, these controls can be overcome in the case of the `q` and `inode` parameters to the `/categoriesServlet` path. This allows for blind boolean SQL injection vectors in either parameter. The `/categoriesServlet` web path can be accessed remotely and without authentication in a default dotCMS deployment.