Permissions, Privileges, and Access Controls in Palo Alto PAN-OS - CVE-2016-9151

Vulnerability details

The vulnerability allows a local authenticated user to execute arbitrary code.

Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows local users to gain privileges via crafted values of unspecified environment variables.

Affected software

How to mitigate CVE-2016-9151

Links to Public Exploits and PoC-codes

• Exploit #3567 - Palo Alto Networks PanOS root_reboot - Privilege Escalation (July 20, 2020)
• Exploit #3568 - Palo Alto Networks PanOS root_trace - Privilege Escalation (July 20, 2020)

External References

• http://www.securityfocus.com/bid/94400
• http://www.securitytracker.com/id/1037381
• https://security.paloaltonetworks.com/CVE-2016-9151
• https://www.exploit-db.com/exploits/40788/
• https://www.exploit-db.com/exploits/40789/

Related Security Bulletins

• Multiple vulnerabilities in Palo Alto PAN-OS