Palo Alto Networks PAN-OS 5.0.x < 5.0.20 / 5.1.x < 5.1.13 / 6.0.x < 6.0.15 / 6.1.x < 6.1.15 / 7.0.x < 7.0.11 / 7.1.x < 7.1.6 Multiple Vulnerabilities (PAN-SA-2016-0033 / PAN-SA-2016-0034 / PAN-SA-2016-0035 / PAN-SA-2016-0037)

Critical Nessus Plugin ID 95478


The remote host is affected by multiple vulnerabilities.


The version of Palo Alto Networks PAN-OS running on the remote host is 5.0.x prior to 5.0.20, 5.1.x prior to 5.1.13, 6.0.x prior to 6.0.15, 6.1.x prior to 6.1.15, 7.0.x prior to 7.0.11, or 7.1.x prior to 7.1.6.
It is, therefore, affected by multiple vulnerabilities :

- An information disclosure vulnerability exists in the Address Object Parsing functionality due to a failure to properly escape single quote characters. An unauthenticated, remote attacker can exploit this to inject XPath content, resulting in the disclosure of sensitive information. (CVE-2016-9149)

- An off-by-one buffer overflow condition exists in the management web interface within the mprItoa() function.
An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a denial of service condition or the execution of arbitrary code.

- An elevation of privilege vulnerability exists in /usr/local/bin/root_trace due to improper validation of the PYTHONPATH environment variable. A local attacker who has shell access can exploit this vulnerability, by manipulating environment variables, to execute code with root privileges. Note that this vulnerability exists because of an incomplete fix for CVE-2016-1712.

- A cross-site scripting (XSS) vulnerability exists in the Captive Portal due to improper validation of input before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (VulnDB 146509)


Upgrade to Palo Alto Networks PAN-OS version 5.0.20 / 5.1.13 / 6.0.15 / 6.1.15 / 7.0.11 / 7.1.6 or later.

See Also

Plugin Details

Severity: Critical

ID: 95478

File Name: palo_alto_PAN-SA-2016-0035.nasl

Version: $Revision: 1.5 $

Type: combined

Published: 2016/12/02

Modified: 2017/06/29

Dependencies: 72816

Risk Information

Risk Factor: Critical


Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C


Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:paloaltonetworks:pan-os

Required KB Items: Host/Palo_Alto/Firewall/Version, Host/Palo_Alto/Firewall/Full_Version

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2016/11/17

Vulnerability Publication Date: 2016/10/31

Reference Information

CVE: CVE-2016-9149, CVE-2016-9150, CVE-2016-9151

BID: 94199, 94399, 94400, 94401

OSVDB: 146509, 147483, 147484, 147487