PT-2013-5715 · Palo Alto Networks · Pan-Os

Published 2013-01-07 · Updated 2018-08-13 · CVE-2013-5663

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions prior to 4.0.14 Palo Alto Networks PAN-OS versions 4.1.x prior to 4.1.11 Palo Alto Networks PAN-OS versions 5.0.x prior to 5.0.2

Description The issue allows remote attackers to bypass intended security policies via crafted requests that trigger invalid caching. This can result in the incorrect identification of traffic, such as identifying HTTP traffic as SIP traffic. A knowledgeable user can bypass security policy by sending specially crafted requests to poison the firewall's App-ID cache, allowing the use of a blocked application for a period of time.

Recommendations For versions prior to 4.0.14, update to version 4.0.14 or later. For versions 4.1.x prior to 4.1.11, update to version 4.1.11 or later. For versions 5.0.x prior to 5.0.2, update to version 5.0.2 or later. As a temporary workaround, consider using one or both of the mitigation steps noted by the vendor while they further enhance the App-ID cache feature to resist all possible pollution techniques.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-5663

Affected Products

Pan-Os

References · 5

• 🔥 http://pastie.org/pastes/5568186/text · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-5663 · Security Note
• https://security.paloaltonetworks.com/CVE-2013-5663 · Note
• http://cansecwest.com/csw11/Network%20Application%20FW%20vs.%20Contemporary%20Threats%20%28Brad%20Woodberg%20-%20Final%29.pptx · Note
• http://researchcenter.paloaltonetworks.com/2013/01/app-id-cache-pollution-update · Note