SB2023020867 - Multiple vulnerabilities in Cortex XDR Agent for Windows

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Security features bypass (CVE-ID: CVE-2023-0002)

The vulnerability allows a local user to disable the agent.

The vulnerability exists due to improperly imposed security restrictions. A local user can execute privileged cytool commands that disable or uninstall the agent.

2) Cleartext storage of sensitive information (CVE-ID: CVE-2023-0001)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores credentials in an insecure manner. A local system administrator can disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent.

Remediation

Install update from vendor's website.

References

• https://security.paloaltonetworks.com/CVE-2023-0002
• https://security.paloaltonetworks.com/CVE-2023-0001