Palo Alto PAN-OS up to 7.1.18/8.0.11/8.1.2 GlobalProtect Portal/GlobalProtect Gateway format string

Summaryinfo

A vulnerability identified as critical has been detected in Palo Alto PAN-OS up to 7.1.18/8.0.11/8.1.2. Impacted is an unknown function of the component GlobalProtect Portal/GlobalProtect Gateway. This manipulation causes input validation. This vulnerability is registered as CVE-2019-1579. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

Detailsinfo

A vulnerability classified as critical was found in Palo Alto PAN-OS up to 7.1.18/8.0.11/8.1.2 (Firewall Software). Affected by this vulnerability is some unknown functionality of the component GlobalProtect Portal/GlobalProtect Gateway. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

The weakness was published 07/19/2019 (Website). The advisory is shared at securityfocus.com. This vulnerability is known as CVE-2019-1579 since 12/06/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but an exploit is available.

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 01/10/2022 with a due date of 07/10/2022:

Apply updates per vendor instructions.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-137459, VDB-137600, VDB-138214 and VDB-138844. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Palo Alto

Name

• PAN-OS

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8
• 7.1.9
• 7.1.10
• 7.1.11
• 7.1.12
• 7.1.13
• 7.1.14
• 7.1.15
• 7.1.16
• 7.1.17
• 7.1.18
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 8.0.6
• 8.0.7
• 8.0.8
• 8.0.9
• 8.0.10
• 8.0.11
• 8.1.0
• 8.1.1
• 8.1.2

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion