PT-2017-18018 · Palo Alto Networks · Pan-Os

Rich Hansen · Publicado 2017-04-28 · Atualizado 2020-02-17 · CVE-2017-7945

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 6.1.16 and earlier Palo Alto Networks PAN-OS versions 7.0.14 and earlier Palo Alto Networks PAN-OS versions 7.1.8 and earlier Palo Alto Networks PAN-OS versions 8.0.1 and earlier

Description The issue allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests to the GlobalProtect external interface. This is due to the interface providing different error messages for failed login attempts depending on whether the username exists. Successful exploitation may allow a malicious user to conduct a brute force attack against the PAN-OS GlobalProtect external interface.

Recommendations For versions 6.1.16 and earlier, update to version 6.1.17 or later. For versions 7.0.14 and earlier, update to version 7.0.15 or later. For versions 7.1.8 and earlier, update to version 7.1.9 or later. For versions 8.0.1 and earlier, update to version 8.0.2 or later.

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

CVE-2017-7945

Produtos afetados

Pan-Os

Referências · 3

• https://security.paloaltonetworks.com/CVE-2017-7945 · Nota
• https://osv.dev/vulnerability/CVE-2017-7945 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7945 · Nota de Segurança