PT-2022-12953 · Palo Alto Networks · Globalprotect

Adam Crosser + 2 · Published 2022-02-10 · Updated 2022-02-17 · CVE-2022-0016

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks GlobalProtect app versions earlier than 5.2.9

Description An improper handling of exceptional conditions issue exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app. This enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. The issue impacts the GlobalProtect app on Windows and MacOS.

Recommendations For GlobalProtect app versions earlier than 5.2.9, update to version 5.2.9 or later to resolve the issue. As a temporary workaround, consider disabling the Connect Before Logon feature until a patch is available. Restrict access to the GlobalProtect app on Windows and MacOS to minimize the risk of exploitation.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-703

Related Identifiers

CVE-2022-0016

Affected Products

Globalprotect

References · 5

• https://osv.dev/vulnerability/CVE-2022-0016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0016 · Security Note
• https://security.paloaltonetworks.com/CVE-2022-0016 · Vendor Advisory
• https://t.me/cibsecurity/37248 · Telegram Post
• https://t.me/cvenotify/26902 · Telegram Post