PT-2021-4802 · Palo Alto Networks · Prisma Access+2

Nicholas Newsom · Published 2021-11-10 · Updated 2021-11-15 · CVE-2021-3056

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PAN-OS versions earlier than 8.1.20 PAN-OS versions earlier than 9.0.14 PAN-OS versions earlier than 9.1.9 PAN-OS versions earlier than 10.0.1

Description A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication. This issue impacts Prisma Access customers with Prisma Access 2.1 Preferred firewalls.

Recommendations For PAN-OS versions earlier than 8.1.20, update to version 8.1.20 or later. For PAN-OS versions earlier than 9.0.14, update to version 9.0.14 or later. For PAN-OS versions earlier than 9.1.9, update to version 9.1.9 or later. For PAN-OS versions earlier than 10.0.1, update to version 10.0.1 or later. As a temporary workaround, consider restricting access to the SAML authentication process until a patch is available.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-787

Related Identifiers

BDU:2021-05527

CVE-2021-3056

Affected Products

Globalprotect

Pan-Os

Prisma Access

References · 6

• https://osv.dev/vulnerability/CVE-2021-3056 · Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2021-3056 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05527 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-3056 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/671306 · Security Note
• https://t.me/cibsecurity/32189 · Telegram Post