SB2020081269 - Security restrictions bypass in Palo Alto PAN-OS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020081269

SB2020081269 - Security restrictions bypass in Palo Alto PAN-OS

Published: August 12, 2020 Updated: December 27, 2021

Security Bulletin ID SB2020081269
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Input validation error (CVE-ID: CVE-2020-2035)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication (SNI) field within the TLS Client Hello handshake.

This allows a compromised host in a protected network to evade any security policy that uses URL filtering on a firewall configured with SSL Decryption in the Forward Proxy mode. A malicious actor can then use this technique to evade detection of communication on the TLS handshake phase between a compromised host and a remote malicious server.


Remediation

Install update from vendor's website.

References