Palo Alto PAN-OS up to 8.1.14/9.0.8/9.1.2 Authentication Interface Request buffer overflow

Summaryinfo

A vulnerability, which was classified as very critical, was found in Palo Alto PAN-OS up to 8.1.14/9.0.8/9.1.2. This vulnerability affects unknown code of the component Authentication Interface. Such manipulation as part of Request leads to buffer overflow. This vulnerability is listed as CVE-2020-2040. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Palo Alto PAN-OS up to 8.1.14/9.0.8/9.1.2 (Firewall Software) and classified as very critical. Affected by this issue is some unknown functionality of the component Authentication Interface. The manipulation as part of a Request leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.

The weakness was presented 09/09/2020 (Website). The advisory is shared for download at security.paloaltonetworks.com. This vulnerability is handled as CVE-2020-2040 since 12/04/2019. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $25k-$100k (estimation calculated on 09/09/2020).

As 0-day the estimated underground price was around $100k and more.

Upgrading to version 8.1.15, 9.0.9 or 9.1.3 eliminates this vulnerability.

See VDB-160992, VDB-160991, VDB-160990 and VDB-160989 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Palo Alto

Name

• PAN-OS

Version

• 8.1.0
• 8.1.1
• 8.1.2
• 8.1.3
• 8.1.4
• 8.1.5
• 8.1.6
• 8.1.7
• 8.1.8
• 8.1.9
• 8.1.10
• 8.1.11
• 8.1.12
• 8.1.13
• 8.1.14
• 9.0.0
• 9.0.1
• 9.0.2
• 9.0.3
• 9.0.4
• 9.0.5
• 9.0.6
• 9.0.7
• 9.0.8
• 9.1.0
• 9.1.1
• 9.1.2

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion