Palo Alto Networks patches critical vulnerability in firewall OS

guest · Jun 29, 2020

Palo Alto Networks patches critical vulnerability in firewall OS
June 29, 2020
https://www.bleepingcomputer.com/ne...atches-critical-vulnerability-in-firewall-os/

Palo Alto Networks disclosed a critical vulnerability found in the operating system (PAN-OS) of all its next-generation firewalls that could allow unauthenticated network-based attackers to bypass authentication.

According to the company's website, PAN‑OS is the software that powers all of its next-generation firewalls.

"When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources," the company's security advisory reads.
Click to expand...

Only affects devices where SAML authentication is enabled
The vulnerability tracked as CVE-2020-2021 has been rated as critical severity with a CVSS 3.x base score of 10, and it could be exploited by threat actors with network access to vulnerable servers as part of low complexity attacks.

Detailed instructions on how to check for the configuration required for exposure and how to mitigate are available in this knowledge base article.
Palo Alto Networks says that no malicious attempts to exploit the CVE-2020-2021 vulnerability were detected until the security advisory was published.
Click to expand...

guest · Jun 30, 2020

Hackers primed to exploit CVSS 10-rated flaw in Palo Alto's PAN-OS
June 30, 2020
https://www.itpro.co.uk/security/vu...ploit-cvss-10-rated-flaw-in-palo-altos-pan-os

US Cyber Command has urged Palo Alto customers to their patch PAN-OS networking systems before cyber criminals have the opportunity to exploit a highly critical authentication vulnerability.

Assigned a rare CVSS score of 10/10, the flaw dubbed CVE-2020-2021 can allow an attacker to bypass authentication procedures and access a device without needing to provide credentials.

“Please patch all devices affected by CVE-2020-2021 immediately, especially if SAML is in use,” US Cyber Command has tweeted. “Foreign APTs will likely attempt exploit soon. We appreciate Palo Alto Networks’ proactive response to this vulnerability.”
Vulnerabilities assigned a 10/10 rating on the CVSS scale are rare, and normally mean the exploit is highly exploitable, easy to trigger, and require little or no additional privileges and user interaction.
Click to expand...

For evidence of a compromise, the company has urged customers to examine Authentication Logs, User-ID Logs, ACC NEtwork Activity Source/Destination Regions, Customers Reports, and GlobalProtect Logs in PAN-OS 9.1.0 and above.
Click to expand...

guest · Jul 8, 2020

Palo Alto Networks fixes another severe flaw in PAN-OS devices
July 8, 2020
https://www.bleepingcomputer.com/ne...-fixes-another-severe-flaw-in-pan-os-devices/

Palo Alto Networks (PAN) today addressed another severe vulnerability found in the PAN-OS GlobalProtect portal and affecting unpatched PAN next-generation firewalls.

The OS command injection vulnerability patched today and tracked as CVE-2020-2034 allows unauthenticated remote attackers to execute arbitrary OS commands with root privileges on unpatched devices.
The CVE-2020-2034 vulnerability has been rated as high severity with a CVSS 3.x base score of 8.1, and it can be exploited by threat actors with network access to vulnerable servers as part of high complexity attacks that don't require user interaction.
Only affects devices with GlobalProtect portal enabled

"This issue can not be exploited if GlobalProtect portal feature is not enabled," PAN's security advisory explains. "Prisma Access services are not impacted by this vulnerability."
PAN-OS 7.1 and PAN-OS 8.0 are end-of-life and will not receive security updates to address this vulnerability.
Click to expand...

Attackers need additional knowledge for exploitation
"An attacker would require some level of specific information about the configuration of an impacted firewall or perform brute-force attacks to exploit this issue," Palo Alto Networks' security advisory reads.
Click to expand...

guest · Sep 10, 2020

Vulnerabilities discovered in PAN-OS, which powers Palo Alto Networks’ firewalls
September 10, 2020
https://www.helpnetsecurity.com/2020/09/10/vulnerabilities-discovered-in-pan-os/

Palo Alto Networks remediated vulnerabilities in PAN-OS (operating systems version 8.1 or later).
Attackers can use these vulnerabilities to gain access to sensitive data or develop the attack to gain access to the internal segments of the network of a company that uses vulnerable protection tools.

Today, over 66,000 companies in 150 countries around the world (comprising 85% of the Fortune 100) use Palo Alto Networks NGFW.
CVE-2020-2037
Vulnerability CVE-2020-2037 (Сommand Injection) has a score of 7.2. It allows executing arbitrary OS commands in the firewall.
CVE-2020-2036
The second vulnerability, CVE-2020-2036 (XSS), has a score of 8.8. If a potential victim authorizes in the administrator panel and clicks a specially crafted malicious link, attackers will be able to perform any actions on behalf of this user in the context of the Palo Alto application, spoof pages, and develop attacks.
Click to expand...

CVE-2020-2038
One more vulnerability, CVE-2020-2038, with a score of 7.2 was detected in the PAN-OS software interface. It extends the set of system commands enabling a variety of potential attacks (as the first vulnerability, it is Command Injection).
CVE-2020-2039
Finally, the fourth vulnerability (CVE-2020-2039, score 5.3) allows an unauthorized user to upload arbitrary files of any size to a certain directory on the server, which might lead to denial of service.
Click to expand...

guest · Sep 11, 2020

Palo Alto Networks fixes critical flaw in PAN-OS firewall software
September 11, 2020
https://www.bleepingcomputer.com/ne...es-critical-flaw-in-pan-os-firewall-software/

Palo Alto Networks has fixed a new critical vulnerability affecting multiple versions of PAN-OS, the operating system affecting its next-generation firewalls.

The issue received the identification number CVE-2020-2040 and has a severity score of 9.8 out of 10 and requires no user interaction. An unauthenticated attacker can exploit it by sending a malicious request to specific interfaces.
Code execution potential
In an advisory updated today, the company disclosed that the vulnerability was discovered during an internal security review by Yamata Li, a member of its Threat Research Team.

The same researcher is credited for finding another critical-severity flaw in PAN-OS (command injection CVE-2020-2034) that allows executing arbitrary commands with root privileges and without the need to authenticate.
Click to expand...

If upgrading to the latest PAN-OS is not possible, Palo Alto Networks advises enabling signatures in content update version 8317 to block attacks against CVE-2020-2040.
Palo Alto Networks says that at this time there is no evidence to suggest that the vulnerability is actively exploited in the wild and there are no indicators of compromise or breach at this time.
Click to expand...

Log in or Sign up

Palo Alto Networks patches critical vulnerability in firewall OS

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Palo Alto Networks patches critical vulnerability in firewall OS

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches