{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2020-045.pdf"
    },
    "title": "Vulnerabilities in Palo Alto PAN-OS",
    "serial_number": "2020-045",
    "publish_date": "10-09-2020 10:05:00",
    "description": "On 9th of September 2020, Palo Alto released several security advisories, updates, and workarounds to address security vulnerabilities including five high severity vulnerabilities and one critical one for PAN-OS:<br>* CVE-2020-2040 PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled - CVSS score 9.8 (critical)<br>* CVE-2020-2036 PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface - CVSS score 8.8 (high)<br>* CVE-2020-2041 PAN-OS: Management web interface denial-of-service (DoS) - CVSS score 7.5 (high)<br>* CVE-2020-2037 PAN-OS: OS command injection vulnerability in the management web interface - CVSS score 7.2 (high)<br>* CVE-2020-2038 PAN-OS: OS command injection vulnerability in the management web interface - CVSS score 7.2 (high)<br>* CVE-2020-2042 PAN-OS: Buffer overflow in the management web interface - CVSS score 7.2 (high)<br>The critical vulnerability is exploitable only if Captive Portal or Multi-Factor Authentication (MFA) are enabled and does not impact GlobalProtect VPN or PAN-OS management web interfaces.<br>As of today, there is no known public proof-of-concept, however this type of vulnerabilities trigger high interest for different threat actors and proof-of-concept usually emerges quite quickly after the release of a patch. For this reason, it is highly recommended to patch the exposed PAN-OS devices as soon as possible.",
    "url_title": "2020-045",
    "content_markdown": "---\ntitle: 'Vulnerabilities in\u00a0Palo Alto PAN-OS'\nversion: '1.0'\nnumber: '2020-045'\ndate: 'September 10, 2020'\n---\n\n_History:_\n\n* _10/09/2020 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn 9th of September 2020, Palo Alto released several security advisories, updates, and workarounds to address security vulnerabilities including five high severity vulnerabilities and one critical one for PAN-OS [1-6]:\n\n* CVE-2020-2040 PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled - CVSS score 9.8 (critical)\n* CVE-2020-2036 PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface - CVSS score 8.8 (high)\n* CVE-2020-2041 PAN-OS: Management web interface denial-of-service (DoS) - CVSS score 7.5 (high)\n* CVE-2020-2037 PAN-OS: OS command injection vulnerability in the management web interface - CVSS score 7.2 (high)\n* CVE-2020-2038 PAN-OS: OS command injection vulnerability in the management web interface - CVSS score 7.2 (high)\n* CVE-2020-2042 PAN-OS: Buffer overflow in the management web interface - CVSS score 7.2 (high)\n\nThe critical vulnerability is exploitable only if Captive Portal or Multi-Factor Authentication (MFA) are enabled and does not impact GlobalProtect VPN or PAN-OS management web interfaces.\n\nAs of today, there is no known public proof-of-concept, however this type of vulnerabilities trigger high interest for different threat actors and proof-of-concept usually emerges quite quickly after the release of a patch. For this reason, it is highly recommended to patch the exposed PAN-OS devices as soon as possible.\n\n# Technical Details\n\n**CVE-2020-2040 (CVSS Score: Base 9.8)**\n\nA buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue does not impact the GlobalProtect VPN or the PAN-OS management web interfaces [4]\n\n**CVE-2020-2036 (CVSS Score: Base 8.8)**\n\nA reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions [1].\n\n**CVE-2020-2041 (CVSS Score: Base 7.5)**\n\nAn insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode [5].\n\n**CVE-2020-2037 (CVSS Score: Base 7.2)**\n\nAn OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges [2].\n\n**CVE-2020-2038 (CVSS Score: Base 7.2)**\n\nAn OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges [3].\n\n**CVE-2020-2042 (CVSS Score: Base 7.2)**\n\nA buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges [6].\n\nPalo Alto Networks is not aware of any malicious attempts to exploit these vulnerabilities [1-6].\n\n# Products Affected\n\nThese vulnerabilities affect several versions of PAN-OS:\n\n* PAN-OS 10.0;\n* PAN-OS 9.1;\n* PAN-OS 9.0;\n* PAN-OS 8.1;\n\nFor specific affected versions, please refer to the Palo Alto security page [7].\n\n# Recommendations\n\nCERT-EU recommends updating the vulnerable applications and systems or applying workarounds as soon as possible.\n\n# References\n\n[1] <https://security.paloaltonetworks.com/CVE-2020-2036>\n\n[2] <https://security.paloaltonetworks.com/CVE-2020-2037>\n\n[3] <https://security.paloaltonetworks.com/CVE-2020-2038>\n\n[4] <https://security.paloaltonetworks.com/CVE-2020-2040>\n\n[5] <https://security.paloaltonetworks.com/CVE-2020-2041>\n\n[6] <https://security.paloaltonetworks.com/CVE-2020-2042>\n\n[7] <https://security.paloaltonetworks.com/>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>10/09/2020 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On 9th of September 2020, Palo Alto released several security advisories, updates, and workarounds to address security vulnerabilities including five high severity vulnerabilities and one critical one for PAN-OS [1-6]:</p><ul><li>CVE-2020-2040 PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled - CVSS score 9.8 (critical)</li><li>CVE-2020-2036 PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface - CVSS score 8.8 (high)</li><li>CVE-2020-2041 PAN-OS: Management web interface denial-of-service (DoS) - CVSS score 7.5 (high)</li><li>CVE-2020-2037 PAN-OS: OS command injection vulnerability in the management web interface - CVSS score 7.2 (high)</li><li>CVE-2020-2038 PAN-OS: OS command injection vulnerability in the management web interface - CVSS score 7.2 (high)</li><li>CVE-2020-2042 PAN-OS: Buffer overflow in the management web interface - CVSS score 7.2 (high)</li></ul><p>The critical vulnerability is exploitable only if Captive Portal or Multi-Factor Authentication (MFA) are enabled and does not impact GlobalProtect VPN or PAN-OS management web interfaces.</p><p>As of today, there is no known public proof-of-concept, however this type of vulnerabilities trigger high interest for different threat actors and proof-of-concept usually emerges quite quickly after the release of a patch. For this reason, it is highly recommended to patch the exposed PAN-OS devices as soon as possible.</p><h2 id=\"technical-details\">Technical Details</h2><p><strong>CVE-2020-2040 (CVSS Score: Base 9.8)</strong></p><p>A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue does not impact the GlobalProtect VPN or the PAN-OS management web interfaces [4]</p><p><strong>CVE-2020-2036 (CVSS Score: Base 8.8)</strong></p><p>A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions [1].</p><p><strong>CVE-2020-2041 (CVSS Score: Base 7.5)</strong></p><p>An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode [5].</p><p><strong>CVE-2020-2037 (CVSS Score: Base 7.2)</strong></p><p>An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges [2].</p><p><strong>CVE-2020-2038 (CVSS Score: Base 7.2)</strong></p><p>An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges [3].</p><p><strong>CVE-2020-2042 (CVSS Score: Base 7.2)</strong></p><p>A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges [6].</p><p>Palo Alto Networks is not aware of any malicious attempts to exploit these vulnerabilities [1-6].</p><h2 id=\"products-affected\">Products Affected</h2><p>These vulnerabilities affect several versions of PAN-OS:</p><ul><li>PAN-OS 10.0;</li><li>PAN-OS 9.1;</li><li>PAN-OS 9.0;</li><li>PAN-OS 8.1;</li></ul><p>For specific affected versions, please refer to the Palo Alto security page [7].</p><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU recommends updating the vulnerable applications and systems or applying workarounds as soon as possible.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://security.paloaltonetworks.com/CVE-2020-2036\">https://security.paloaltonetworks.com/CVE-2020-2036</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://security.paloaltonetworks.com/CVE-2020-2037\">https://security.paloaltonetworks.com/CVE-2020-2037</a></p><p>[3] <a rel=\"noopener\" target=\"_blank\" href=\"https://security.paloaltonetworks.com/CVE-2020-2038\">https://security.paloaltonetworks.com/CVE-2020-2038</a></p><p>[4] <a rel=\"noopener\" target=\"_blank\" href=\"https://security.paloaltonetworks.com/CVE-2020-2040\">https://security.paloaltonetworks.com/CVE-2020-2040</a></p><p>[5] <a rel=\"noopener\" target=\"_blank\" href=\"https://security.paloaltonetworks.com/CVE-2020-2041\">https://security.paloaltonetworks.com/CVE-2020-2041</a></p><p>[6] <a rel=\"noopener\" target=\"_blank\" href=\"https://security.paloaltonetworks.com/CVE-2020-2042\">https://security.paloaltonetworks.com/CVE-2020-2042</a></p><p>[7] <a rel=\"noopener\" target=\"_blank\" href=\"https://security.paloaltonetworks.com/\">https://security.paloaltonetworks.com/</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}