Palo Alto Global Protect Agent up to 4.1.12/5.0.4 on Windows Unquoted Search Path unquoted search path

Summaryinfo

A vulnerability was found in Palo Alto Global Protect Agent up to 4.1.12/5.0.4 on Windows. It has been declared as critical. The impacted element is an unknown function of the component Unquoted Search Path. Such manipulation leads to unquoted search path. This vulnerability is traded as CVE-2020-1988. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Palo Alto Global Protect Agent up to 4.1.12/5.0.4 on Windows. Affected by this issue is some unknown processing of the component Unquoted Search Path. The manipulation with an unknown input leads to a unquoted search path vulnerability. Using CWE to declare the problem leads to CWE-428. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An unquoted search path vulnerability in the Windows release of Global Protect Agent allows an authenticated local user with file creation privileges on the root of the OS disk (C:\) or to Program Files directory to gain system privileges. This issue affects Palo Alto Networks GlobalProtect Agent 5.0 versions before 5.0.5; 4.1 versions before 4.1.13 on Windows;

The weakness was shared 04/08/2020. This vulnerability is handled as CVE-2020-1988 since 12/04/2019. The attack needs to be approached locally. Required for exploitation is a simple authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1574.009.

Upgrading to version 4.1.13 or 5.0.5 eliminates this vulnerability.

The entry VDB-152985 is related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Palo Alto

Name

• Global Protect Agent

Version

• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.1.8
• 4.1.9
• 4.1.10
• 4.1.11
• 4.1.12
• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion