Yamata Li

Name of the Vulnerable Software and Affected Versions: PAN-OS versions 8.0 PAN-OS 8.1 versions earlier than 8.1.15 PAN-OS 9.0 versions earlier than 9.0.9 PAN-OS 9.1 versions earlier than 9.1.3 Description: A buffer overflow vulnerability in PAN-OS is related to the lack of size checking for input data. This issue can be exploited by an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the "Captive Portal" or "Multi-Factor Authentication" interface. Recommendations: For PAN-OS version 8.0, update to a version later than 8.0. For PAN-OS 8.1 versions earlier than 8.1.15, update to version 8.1.15 or later. For PAN-OS 9.0 versions earlier than 9.0.9, update to version 9.0.9 or later. For PAN-OS 9.1 versions earlier than 9.1.3, update to version 9.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** Palo Alto Networks PAN-OS versions prior to 8.1.16 Palo Alto Networks PAN-OS versions 9.0 prior to 9.0.10 Palo Alto Networks PAN-OS versions 9.1 prior to 9.1.3 **Description** An information exposure through log file vulnerability may occur where an administrator's password or other sensitive information is logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file, which tracks operational command usage, did not mask all sensitive information. This issue is resolved in PAN-OS 9.1 and later versions, where the opcmdhistory.log file is removed and command usage is recorded in the req stats.log file instead. **Recommendations** For PAN-OS 8.1 versions earlier than 8.1.16, update to PAN-OS 8.1.16 or later. For PAN-OS 9.0 versions earlier than 9.0.10, update to PAN-OS 9.0.10 or later. For PAN-OS 9.1 versions earlier than 9.1.3, update to PAN-OS 9.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** PAN-OS versions prior to 9.1.3 PAN-OS versions prior to 8.1.15 PAN-OS versions prior to 9.0.9 PAN-OS 8.0 (all versions) PAN-OS 7.1 (all versions) **Description** An OS Command Injection issue in the GlobalProtect portal allows an unauthenticated network-based attacker to execute arbitrary OS commands with root privileges. The attacker requires some knowledge of the firewall or may perform brute-force attacks to exploit this issue. This issue cannot be exploited if the GlobalProtect portal feature is not enabled. Palo Alto Networks is not aware of any malicious attempts to exploit this issue. **Recommendations** For PAN-OS 9.1 versions earlier than 9.1.3, update to version 9.1.3 or later. For PAN-OS 8.1 versions earlier than 8.1.15, update to version 8.1.15 or later. For PAN-OS 9.0 versions earlier than 9.0.9, update to version 9.0.9 or later. For PAN-OS 8.0 and PAN-OS 7.1, consider upgrading to a newer version of PAN-OS that is not vulnerable to this issue. As a temporary workaround, consider disabling the GlobalProtect portal feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office versions XP SP3, 2003 SP3 **Description** A buffer overflow issue exists in the way Microsoft Office handles CGM image files, allowing remote attackers to execute arbitrary code via a crafted CGM image in an Office document. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights. **Recommendations** For Microsoft Office XP SP3, update to a version that fixes the buffer overflow issue in the CGM image converter. For Microsoft Office 2003 SP3, update to a version that fixes the buffer overflow issue in the CGM image converter. As a temporary workaround, consider avoiding the use of CGM image files in Office documents until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office XP SP3 Microsoft Office 2003 SP3 Microsoft Office Converter Pack **Description** The issue is related to an integer overflow in the PICT image converter, allowing remote attackers to execute arbitrary code via a crafted PICT image in an Office document. A remote code execution vulnerability exists in the way that Microsoft Office allocates buffer size when handling PICT image files. If a user opens an Office document containing a specially crafted PICT image, an attacker could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Office XP SP3, update to a version that fixes the integer overflow in the PICT image converter. For Microsoft Office 2003 SP3, update to a version that fixes the integer overflow in the PICT image converter. For Microsoft Office Converter Pack, update to a version that fixes the integer overflow in the PICT image converter. As a temporary workaround, consider avoiding the use of PICT image files in Office documents until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fixed version **Description** A remote code execution issue exists in the way Microsoft MPEG Layer-3 codecs handle AVI media files. This could allow remote code execution if a user opens a specially crafted AVI file containing an MPEG Layer-3 audio stream. If a user is logged on with administrative user rights, an attacker who successfully exploits this issue could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users operating with administrative user rights. **Recommendations** For Microsoft Windows versions prior to the fixed version, apply the necessary patch to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions 7.0 through 9.0c Description: The issue arises from the QuickTime Movie Parser Filter in quartz.dll, which fails to properly validate size fields in QuickTime media files. This allows remote attackers to execute arbitrary code via a crafted file. Recommendations: For Microsoft DirectX versions 7.0 through 9.0c, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the QuickTime Movie Parser Filter in DirectShow to minimize the risk of arbitrary code execution.

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions 7.0 through 9.0c Description: The issue concerns the QuickTime Movie Parser Filter in quartz.dll, which is part of DirectShow in Microsoft DirectX. It allows remote attackers to execute arbitrary code via a crafted QuickTime media file due to improper validation of unspecified data values when updating pointers. Recommendations: For Microsoft DirectX versions 7.0 through 9.0c, consider restricting the use of the QuickTime Movie Parser Filter until a patch is available. As a temporary workaround, avoid using the affected filter to parse QuickTime media files.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 **Description** The issue concerns the WebDAV extension in Microsoft Internet Information Services (IIS) 5.0, which fails to properly decode URLs. This allows remote attackers to bypass authentication and potentially read or create files by sending a crafted HTTP request. **Recommendations** For Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4, consider disabling the WebDAV extension as a temporary workaround until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Microsoft Agent version 2.0.0.3425 Description: A stack-based buffer overflow issue exists in the way Microsoft Agent handles certain specially crafted URLs, allowing remote attackers to execute arbitrary code. This issue is triggered via a crafted URL to the Agent (Agent.Control) ActiveX control, leading to an overflow within the Agent Service (agentsrv.exe) process. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights. Recommendations: For Microsoft Agent version 2.0.0.3425, consider restricting access to the Agent Service (agentsrv.exe) process until a patch is available. As a temporary workaround, avoid using the Agent (Agent.Control) ActiveX control with crafted URLs.