Palo Alto Networks patches 9.8 severity CVE in popular GlobalProtect product
Updated Palo Alto Networks (PAN) has issued a patch for a CVSS 9.8-rated buffer overflow affecting a VPN component of its widely used firewall software, warning that the flaw allows unauthenticated attackers to execute arbitrary code on unpatched appliances.
While the current version, 10.1, and three before it are not affected, the vuln, tracked as CVE-2021-3064, still exists in version 8.1.17 and all previous versions of PAN-OS, PAN’s firewall operating system.
“A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges,” said the company in an advisory published this week.
“The attacker must have network access to the GlobalProtect interface to exploit this issue.”
The flaw was found by infosec outfit Randori, which warned that around 10,000 vulnerable firewalls were viewable across the wider internet earlier this week.
Such vulns are rapidly picked up on and exploited by ransomware gangs and nation states; Australia’s Cyber Security Centre issued a warning today urging sysadmins to “apply the available update as soon as possible.”
Randori summarised the vuln by saying: “The vulnerability chain consists of a method for bypassing validations made by an external web server (HTTP smuggling) and a stack-based buffer overflow.”
No exploit has yet been seen in the wild but exploitation is only a matter of time, judging by previous experience.
Furious Reg reader John complained: “Everybody using Palo Alto Networks’ GlobalProtect, who is running only the second newest patch level on the 8.1 train which is still active in the lifecycle, is affected.”
He added: “Memory corruption, really? There are enough code checking tools available which would help the developers to spot this before rolling the product…”
We have asked PAN for comment and will update this article if the firm responds. Earlier this year the company spent $156m buying an open source code-checking company: DevSecOps outfit Bridgecrew.
“Prisma Cloud customers will benefit from a single platform that will deliver cloud security from build time to runtime, seamlessly connecting security and DevOps teams,” burbled PAN at the time.
Perhaps that Checkov tool ought to be directed inwards as well as outwards. ®
Updated at 1741 UTC on 11 November to add
Palo Alto Network sent us a statement following publication of this article:
READ MORE HERE