Detections
Analytics
Palo Alto Networks PAN-OS 5.x < 5.0.9 Multiple Vulnerabilities
medium Nessus Plugin ID 72829
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The remote host is running a version of Palo Alto Networks PAN-OS 5.x prior to 5.0.9. It is, therefore, affected by multiple vulnerabilities :- A security bypass vulnerability exists due to a failure to properly enforce RADIUS users' permissions. An authenticated attacker can exploit this to modify shared objects. (Ref# 55287)
- A cross-site request forgery vulnerability exists due to a failure to properly validate HTTP requests to certain file upload forms, including 'import.certificate.php'.
- Multiple HTML injection vulnerabilities exist due to a failure to sanitize user-supplied input to the 'Name', 'Subject', and 'Issuer' fields in imported certificates.
An attacker can exploit this to inject arbitrary HTML into the device's web interface.
(Ref# 57343)
Solution
Upgrade to PAN-OS version 5.0.9 or later.See Also
Plugin Details
Severity: Medium
ID: 72829
File Name: palo_alto_pan-os_5_0_9.nasl
Version: 1.9
Type: combined
Family: Palo Alto Local Security Checks
Published: 3/5/2014
Updated: 8/8/2018
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.1
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:paloaltonetworks:pan-os
Required KB Items: Host/Palo_Alto/Firewall/Version, Host/Palo_Alto/Firewall/Full_Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/17/2013
Vulnerability Publication Date: 11/21/2013