Palo Alto Networks User-ID Agent < 7.0.4 TLS-Secured API Invocation Credential Disclosure (PAN-SA-2016-0007)

Medium Nessus Plugin ID 91673


The Palo Alto Networks User-ID agent installed on the remote host is affected by a credential disclosure vulnerability.


The version of Palo Alto Networks User-ID agent installed on the remote Windows host is prior to 7.0.4. It is, therefore, affected by a flaw that allows a TLS-secured API call to return encrypted credentials to the domain account configured on the User-ID agent, which has read-only rights for Security Event Logs on Domain Controllers. An authenticated, remote attacker with access to the User-ID agent Service TCP port can exploit this to gain access to credential information.


Upgrade to Palo Alto Networks User-ID agent version 7.0.4

See Also

Plugin Details

Severity: Medium

ID: 91673

File Name: palo_alto_PAN-SA-2016-0007.nasl

Version: $Revision: 1.2 $

Type: local

Agent: windows

Family: Windows

Published: 2016/06/17

Modified: 2016/06/20

Dependencies: 91676

Risk Information

Risk Factor: Medium


Base Score: 4

Temporal Score: 3.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

Vulnerability Information

Required KB Items: installed_sw/Palo Alto User-ID Agent

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2016/05/23

Vulnerability Publication Date: 2016/05/23

Reference Information

OSVDB: 138967