PT-2016-7668 · Palo Alto Networks · Pan-Os

Tavis Ormandy · Published 2016-11-17 · Updated 2020-02-17 · CVE-2016-9151

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 5.0.19 and earlier Palo Alto Networks PAN-OS versions 5.1.12 and earlier Palo Alto Networks PAN-OS versions 6.0.14 and earlier Palo Alto Networks PAN-OS versions 6.1.14 and earlier Palo Alto Networks PAN-OS versions 7.0.10 and earlier Palo Alto Networks PAN-OS versions 7.1.5 and earlier

Description The issue allows local users to gain privileges via crafted values of unspecified environment variables. A potential attacker with local shell access could manipulate arbitrary environment variables, which could result in a process running with higher privileges.

Recommendations For versions 5.0.19 and earlier, update to version 5.0.20 or later. For versions 5.1.12 and earlier, update to version 5.1.13 or later. For versions 6.0.14 and earlier, update to version 6.0.15 or later. For versions 6.1.14 and earlier, update to version 6.1.15 or later. For versions 7.0.10 and earlier, update to version 7.0.11 or later. For versions 7.1.5 and earlier, update to version 7.1.6 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-9151

Affected Products

Pan-Os

References · 7

• 🔥 https://exploit-db.com/exploits/40788 · Exploit
• 🔥 https://exploit-db.com/exploits/40789 · Exploit
• https://osv.dev/vulnerability/CVE-2016-9151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9151 · Security Note
• http://securityfocus.com/bid/94400 · Note
• https://security.paloaltonetworks.com/CVE-2016-9151 · Note
• http://securitytracker.com/id/1037381 · Note