PT-2016-4899 · Palo Alto Networks · Pan-Os

Kasif Dekel · Publicado 2016-07-13 · Atualizado 2020-02-17 · CVE-2016-1712

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 5.0.18 and earlier Palo Alto Networks PAN-OS versions 5.1.11 and earlier Palo Alto Networks PAN-OS versions 6.0.13 and earlier Palo Alto Networks PAN-OS versions 6.1.11 and earlier Palo Alto Networks PAN-OS versions 7.0.7 and earlier

Description The issue is related to improper sanitization of the root reboot local invocation, which can potentially allow local users to gain privileges. Exploitation of this privilege escalation is restricted to local users, and potential attackers would have to first obtain a shell on the device before they could attempt to escalate privileges through this issue.

Recommendations For versions 5.0.18 and earlier, update to version 5.0.19 or later. For versions 5.1.11 and earlier, update to version 5.1.12 or later. For versions 6.0.13 and earlier, update to version 6.0.14 or later. For versions 6.1.11 and earlier, update to version 6.1.12 or later. For versions 7.0.7 and earlier, update to version 7.0.8 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-264

Identificadores relacionados

CVE-2016-1712

Produtos afetados

Pan-Os

Referências · 4

• https://security.paloaltonetworks.com/CVE-2016-1712 · Nota
• http://securitytracker.com/id/1036326 · Nota
• https://osv.dev/vulnerability/CVE-2016-1712 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1712 · Nota de Segurança