PT-2017-18018 · Palo Alto Networks · Pan-Os

Rich Hansen · Published 2017-04-28 · Updated 2020-02-17 · CVE-2017-7945

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 6.1.16 and earlier Palo Alto Networks PAN-OS versions 7.0.14 and earlier Palo Alto Networks PAN-OS versions 7.1.8 and earlier Palo Alto Networks PAN-OS versions 8.0.1 and earlier

Description The issue allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests to the GlobalProtect external interface. This is due to the interface providing different error messages for failed login attempts depending on whether the username exists. Successful exploitation may allow a malicious user to conduct a brute force attack against the PAN-OS GlobalProtect external interface.

Recommendations For versions 6.1.16 and earlier, update to version 6.1.17 or later. For versions 7.0.14 and earlier, update to version 7.0.15 or later. For versions 7.1.8 and earlier, update to version 7.1.9 or later. For versions 8.0.1 and earlier, update to version 8.0.2 or later.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2017-7945

Affected Products

Pan-Os

References · 3

• https://osv.dev/vulnerability/CVE-2017-7945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7945 · Security Note
• https://security.paloaltonetworks.com/CVE-2017-7945 · Note