Detections
Analytics
Palo Alto Networks PAN-OS 5.0.x < 5.0.20 / 5.1.x < 5.1.13 / 6.0.x < 6.0.15 / 6.1.x < 6.1.15 / 7.0.x < 7.0.11 / 7.1.x < 7.1.6 Multiple Vulnerabilities (PAN-SA-2016-0033 / PAN-SA-2016-0034 / PAN-SA-2016-0035 / PAN-SA-2016-0037)
critical Nessus Plugin ID 95478
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The version of Palo Alto Networks PAN-OS running on the remote host is 5.0.x prior to 5.0.20, 5.1.x prior to 5.1.13, 6.0.x prior to 6.0.15, 6.1.x prior to 6.1.15, 7.0.x prior to 7.0.11, or 7.1.x prior to 7.1.6.It is, therefore, affected by multiple vulnerabilities :
- An information disclosure vulnerability exists in the Address Object Parsing functionality due to a failure to properly escape single quote characters. An unauthenticated, remote attacker can exploit this to inject XPath content, resulting in the disclosure of sensitive information. (CVE-2016-9149)
- An off-by-one buffer overflow condition exists in the management web interface within the mprItoa() function.
An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a denial of service condition or the execution of arbitrary code.
(CVE-2016-9150)
- An elevation of privilege vulnerability exists in /usr/local/bin/root_trace due to improper validation of the PYTHONPATH environment variable. A local attacker who has shell access can exploit this vulnerability, by manipulating environment variables, to execute code with root privileges. Note that this vulnerability exists because of an incomplete fix for CVE-2016-1712.
(CVE-2016-9151)
- A cross-site scripting (XSS) vulnerability exists in the Captive Portal due to improper validation of input before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session.
Solution
Upgrade to Palo Alto Networks PAN-OS version 5.0.20 / 5.1.13 / 6.0.15 / 6.1.15 / 7.0.11 / 7.1.6 or later.See Also
https://securityadvisories.paloaltonetworks.com/Home/Detail/66
https://securityadvisories.paloaltonetworks.com/Home/Detail/67
https://securityadvisories.paloaltonetworks.com/Home/Detail/68
https://securityadvisories.paloaltonetworks.com/Home/Detail/70
Plugin Details
Severity: Critical
ID: 95478
File Name: palo_alto_PAN-SA-2016-0035.nasl
Version: 1.7
Type: combined
Family: Palo Alto Local Security Checks
Published: 12/2/2016
Updated: 1/2/2019
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:paloaltonetworks:pan-os
Required KB Items: Host/Palo_Alto/Firewall/Version, Host/Palo_Alto/Firewall/Full_Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/17/2016
Vulnerability Publication Date: 10/31/2016