PT-2016-4899 · Palo Alto Networks · Pan-Os

Kasif Dekel · Published 2016-07-13 · Updated 2020-02-17 · CVE-2016-1712

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 5.0.18 and earlier Palo Alto Networks PAN-OS versions 5.1.11 and earlier Palo Alto Networks PAN-OS versions 6.0.13 and earlier Palo Alto Networks PAN-OS versions 6.1.11 and earlier Palo Alto Networks PAN-OS versions 7.0.7 and earlier

Description The issue is related to improper sanitization of the root reboot local invocation, which can potentially allow local users to gain privileges. Exploitation of this privilege escalation is restricted to local users, and potential attackers would have to first obtain a shell on the device before they could attempt to escalate privileges through this issue.

Recommendations For versions 5.0.18 and earlier, update to version 5.0.19 or later. For versions 5.1.11 and earlier, update to version 5.1.12 or later. For versions 6.0.13 and earlier, update to version 6.0.14 or later. For versions 6.1.11 and earlier, update to version 6.1.12 or later. For versions 7.0.7 and earlier, update to version 7.0.8 or later.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

CVE-2016-1712

Affected Products

Pan-Os

References · 4

• https://osv.dev/vulnerability/CVE-2016-1712 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1712 · Security Note
• https://security.paloaltonetworks.com/CVE-2016-1712 · Note
• http://securitytracker.com/id/1036326 · Note