Detections
Analytics

Palo Alto Networks User-ID Agent < 7.0.4 TLS-Secured API Invocation Credential Disclosure (PAN-SA-2016-0007)

medium Nessus Plugin ID 91673

Language:

Synopsis

The Palo Alto Networks User-ID agent installed on the remote host is affected by a credential disclosure vulnerability.

Description

The version of Palo Alto Networks User-ID agent installed on the remote Windows host is prior to 7.0.4. It is, therefore, affected by a flaw that allows a TLS-secured API call to return encrypted credentials to the domain account configured on the User-ID agent, which has read-only rights for Security Event Logs on Domain Controllers. An authenticated, remote attacker with access to the User-ID agent Service TCP port can exploit this to gain access to credential information.

Solution

Upgrade to Palo Alto Networks User-ID agent version 7.0.4

See Also

https://securityadvisories.paloaltonetworks.com/Home/Detail/40

Plugin Details

Severity: Medium

ID: 91673

File Name: palo_alto_PAN-SA-2016-0007.nasl

Version: 1.4

Type: local

Agent: windows

Family: Windows

Published: 6/17/2016

Updated: 8/8/2018

Supported Sensors: Nessus Agent, Nessus

Vulnerability Information

Required KB Items: installed_sw/Palo Alto User-ID Agent

Patch Publication Date: 5/23/2016

Vulnerability Publication Date: 5/23/2016