SB2016111903 - Multiple vulnerabilities in Palo Alto PAN-OS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016111903

SB2016111903 - Multiple vulnerabilities in Palo Alto PAN-OS

Published: November 19, 2016 Updated: July 18, 2020

Security Bulletin ID SB2016111903
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2016-9151)

The vulnerability allows a local authenticated user to execute arbitrary code.

Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows local users to gain privileges via crafted values of unspecified environment variables.


2) Code Injection (CVE-ID: CVE-2016-9150)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in unspecified vectors. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) Data Handling (CVE-ID: CVE-2016-9149)

The vulnerability allows a remote authenticated user to manipulate data.

The Addresses Object parser in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 mishandles single quote characters, which allows remote authenticated users to conduct XPath injection attacks via a crafted string.


Remediation

Install update from vendor's website.

References