The Palo Alto Networks PAN-OS running on the remote host is version 5.0.x prior to 5.0.18, 5.1.x prior to 5.1.11, 6.0.x prior to 6.0.13, 6.1.x prior to 6.1.10, or 7.0.x prior to 7.0.5-h2. It is, therefore, affected by the following vulnerabilities :

- An unspecified flaw exists in the GlobalProtect web portal   due to improper validation of user-supplied input when   handling requests. An unauthenticated, remote attacker can   exploit this, via a crafted request, to cause a denial of   service.

- A flaw exists in the command line interface (CLI) when   parsing certain SSH command parameters. An authenticated,   remote attacker who has administrative privileges can   exploit this, via a crafted request, to execute arbitrary   OS commands with root privileges.

The Palo Alto Networks PAN-OS running on the remote host is a version prior to 6.1.7 or 7.x prior to 7.0.2. It is, therefore, affected by a security bypass vulnerability due to a failure to invalidate the local administrator API keys after a password change has been performed, the old keys being valid up until the time the device is rebooted. A remote attacker can exploit this to gain access to the management interface.

The remote Panorama appliance is running a version of Palo Alto Networks PAN-OS prior to 6.0.1. It is, therefore, affected by a firmware signature bypass vulnerability due to a flaw in signature verification process that allows an attacker to execute arbitrary Python code within an image file before the signature is verified.
Exploitation of this issue requires convincing an administrator to install a file from a malicious source (e.g. social engineering, hosting on a phishing site, or a man-in-the-middle attack on a legitimate download).

The remote host is running Palo Alto Networks PAN-OS version 7.0.0. It is, therefore, affected by an unspecified flaw in the LDAP authentication process. A remote attacker can exploit this to bypass authentication checks presented by the captive portal component or the device management interfaces.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.16 / 6.0.9 / 6.1.3. It is, therefore, affected by a cross-site vulnerability in the management interface due to improper validation of user-supplied input. A remote attacker can exploit this vulnerability by convincing an authenticated administrator to use a specially crafted request, resulting in execution of arbitrary code in the context of the current user.

The remote host is running a version of Palo Alto Networks PAN-OS equal to or prior to 5.0.15 / 6.0.8 / 6.1.2. It is, therefore, affected by a heap-based buffer overflow in the GNU C Library (glibc) due to improperly validating user-supplied input in the glibc functions __nss_hostname_digits_dots(), gethostbyname(), and gethostbyname2(). This allows a remote attacker to cause a buffer overflow, resulting in a denial of service condition or the execution of arbitrary code.

According to its version, the remote PAN-OS operating system is obsolete and is no longer maintained by Palo Alto Networks.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.15 / 5.1.10 / 6.0.6. It is, therefore, affected by a cross-site scripting vulnerability in the web-based device management interface due to improper user input sanitization.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.15 / 5.1.10 / 6.0.6 / 6.1.1. It is, therefore, affected by a command injection vulnerability in GNU Bash known as Shellshock, which is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via environment variable manipulation depending on the configuration of the system.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.14 / 5.1.9 / 6.0.4. It is, therefore, affected by a flaw in the included OpenSSL library that can cause the client or server to use weak keying material, which a remote attacker can exploit to conduct a man-in-the-middle attack.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.1.16 / 5.0.10 / 5.1.5. It is, therefore, affected by an API key bypass flaw which allows a remote attacker to bypass the XML API key for a session that has already been authorized. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.10 / 5.1.x prior to 5.1.5. It is, therefore, affected by a cross-site scripting vulnerability due to a failure to sanitize user-supplied input to the web-based device management interface.

The remote host is running a version of Palo Alto Networks PAN-OS 5.x prior to 5.0.9. It is, therefore, affected by multiple vulnerabilities :

  - A security bypass vulnerability exists due to a failure     to properly enforce RADIUS users' permissions. An     authenticated attacker can exploit this to modify shared     objects. (Ref# 55287)

  - A cross-site request forgery vulnerability exists due     to a failure to properly validate HTTP requests to     certain file upload forms, including     'import.certificate.php'.

  - Multiple HTML injection vulnerabilities exist due to a     failure to sanitize user-supplied input to the 'Name',     'Subject', and 'Issuer' fields in imported certificates.
    An attacker can exploit this to inject arbitrary HTML     into the device's web interface.
    (Ref# 57343)

The remote host is running version 5.0.9 of Palo Alto Networks PAN-OS.
It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists due to an     inability to handle IP packets larger than 1480 bytes     through an Active/Active VWire setup. An attacker can     exploit this vulnerability to cause packet loss.
    (Ref# 56153)

  - A security bypass vulnerability exists due to a flaw in     Zone Protection when SYN Cookie is enabled. An attacker     can exploit this vulnerability to evade IP spoofing     checks. (Ref# 57059)

  - A security bypass vulnerability exists due to a flaw in     session management when using Global Protect pre-logon     mode. (Ref# 58539)

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.1.13 / 5.0.6. It is, therefore, affected by a cross-site scripting vulnerability due to a failure to sanitize user-supplied input to the device management API browser.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.0.14 / 4.1.11 / 5.0.2. It is, therefore, affected by a security bypass vulnerability due to a flaw in the App-ID cache function. A remote attacker can exploit this vulnerability to run blocked applications.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 3.1.12 / 4.0.10 / 4.1.4. It is, therefore, affected by multiple vulnerabilities :

  - A vulnerability exists that allows an unauthenticated     user to inject commands as root on the device.
    (CVE-2012-6601 / PAN-SA-2012-0012)

  - A vulnerability exists that allows an unauthenticated     user to gain administrator access without supplying     credentials. (CVE-2012-6603 / PAN-SA-2012-0014)

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.0.8 / 4.1.1. It is, therefore, affected by a command injection vulnerability that allows an authenticated user to inject arbitrary shell commands via the CLI.

Note that the 3.0 branch is not affected by this vulnerability.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 3.1.11 / 4.0.9. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists that allows an     authenticated attacker to crash the device via a     specially crafted command sent to the CLI.
    (CVE-2012-6597 / PAN-SA-2012-0008)

  - A vulnerability exists that allows an authenticated user     to inject arbitrary shell commands via the CLI.
    (CVE-2012-6604 / PAN-SA-2012-0015)

  - A vulnerability exists that allows an authenticated user     to inject arbitrary shell commands via the CLI.
    (CVE-2012-6605 / PAN-SA-2012-0016)

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.0.9 / 4.1.3. It is, therefore, affected by an information disclosure vulnerability due to LDAP bind passwords being logged in plaintext when using default logging settings.

Note that the 3.1 branch is not affected by this vulnerability.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.0.9 / 4.1.2.  It is, therefore, affected by multiple command injection vulnerabilities :

  - A vulnerability exists that allows an authenticated user     to inject arbitrary shell commands via the CLI.
    (CVE-2012-6595 / PAN-SA-2012-0006)

  - A vulnerability exists that allows an authenticated user     to inject arbitrary shell commands via the CLI.
    (CVE-2012-6600 / PAN-SA-2012-0011)

Note that the 3.0 branch is not affected by these vulnerabilities.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 3.1.11 / 4.0.8 / 4.1.1. It is, therefore, affected by a command injection vulnerability that allows an authenticated user to inject arbitrary shell commands via the CLI.

The remote host is running a version of Palo Alto Networks PAN-OS prior to 3.1.10 / 4.0.4. It is, therefore, affected by multiple command injection vulnerabilities :

  - A vulnerability exists that allows an unauthenticated     user to inject commands as root on the device.
    (CVE-2012-6593 / PAN-SA-2012-0004)

  - A vulnerability exists that allows an authenticated user     to inject arbitrary shell commands via the CLI.
    (CVE-2012-6602 / PAN-SA-2012-0013)

The remote host is running a version of Palo Alto Networks PAN-OS prior to 3.1.10 / 4.0.5. It is, therefore, affected by multiple command injection vulnerabilities :

  - A vulnerability exists that allows an authenticated user     to inject arbitrary shell commands via the CLI.
    (CVE-2012-6591 / PAN-SA-2012-0002)

  - A vulnerability exists that allows an unauthenticated     user to inject commands as root on the device.
    (CVE-2012-6592 / PAN-SA-2012-0003)

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.0.8. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists due to     overly verbose error messages. An attacker can exploit     this vulnerability by sending specially crafted input in     order to gain access to potentially sensitive     information. (CVE-2012-6590 / PAN-SA-2012-0001)

  - A vulnerability exists that potentially allows an     authenticated user to inject arbitrary shell commands     via the CLI. (CVE-2012-6598 / PAN-SA-2012-0009)

Note that the 3.0 branch is not affected by these vulnerabilities.

ID	Name	Severity
89687	Palo Alto Networks PAN-OS Multiple Vulnerabilities (PAN-SA-2016-0002, PAN-SA-2016-0004)	high
86906	Palo Alto Networks PAN-OS API Key Persistence Security Bypass (PAN-SA-2015-0006)	medium
86186	Palo Alto Networks Panorama PAN-OS < 6.0.1 Firmware Signature Verification Bypass Arbitrary Code Execution	high
85535	Palo Alto Networks PAN-OS 7.0.0 LDAP Authentication Bypass (PAN-SA-2015-0005)	critical
83816	Palo Alto Networks PAN-OS < 5.0.16 / 6.0.x < 6.0.9 / 6.1.x < 6.1.3 XSS	medium
81167	Palo Alto Networks PAN-OS <= 5.0.15 / 6.0.x <= 6.0.8 / 6.1.x <= 6.1.2 GNU C Library (glibc) Buffer Overflow (GHOST)	high
80888	Unsupported PAN-OS Operating System	critical
80281	Palo Alto Networks PAN-OS < 5.0.15 / 5.1.x < 5.1.10 / 6.0.x < 6.0.6 XSS	medium
78587	Palo Alto Networks PAN-OS < 5.0.15 / 5.1.x < 5.1.10 / 6.0.x < 6.0.6 / 6.1.x < 6.1.1 Bash Shell Remote Code Execution (Shellshock)	critical
78586	Palo Alto Networks PAN-OS < 5.0.14 / 5.1.x < 5.1.9 / 6.0.x < 6.0.4 OpenSSL MitM	medium
73138	Palo Alto Networks PAN-OS 4.1.x < 4.1.16 / 5.0.x < 5.0.10 / 5.1.x < 5.1.5 API Key Bypass Flaw	low
72883	Palo Alto Networks PAN-OS < 5.0.10 / 5.1.x < 5.1.5 XSS	low
72829	Palo Alto Networks PAN-OS 5.x < 5.0.9 Multiple Vulnerabilities	medium
72828	Palo Alto Networks PAN-OS 5.0.9 Multiple Vulnerabilities	low
72827	Palo Alto Networks PAN-OS < 4.1.13 / 5.0.x < 5.0.6 XSS	low
72826	Palo Alto Networks PAN-OS < 4.0.14 / 4.1.x < 4.1.11 / 5.0.x < 5.0.2 Security Bypass	medium
72825	Palo Alto Networks PAN-OS < 3.1.12 / 4.0.x < 4.0.10 / 4.1.x < 4.1.4 Multiple Vulnerabilities	critical
72824	Palo Alto Networks PAN-OS < 4.0.8 / 4.1.x < 4.1.1 Command Injection	high
72823	Palo Alto Networks PAN-OS < 3.1.11 / 4.0.x < 4.0.9 Multiple Vulnerabilities	high
72822	Palo Alto Networks PAN-OS < 4.0.9 / 4.1.x < 4.1.3 Information Disclosure	medium
72821	Palo Alto Networks PAN-OS < 4.0.9 / 4.1.x < 4.1.2 Multiple Command Injections	high
72820	Palo Alto Networks PAN-OS < 3.1.11 / 4.0.x < 4.0.8 / 4.1.x < 4.1.1 Command Injection	high
72819	Palo Alto Networks PAN-OS < 3.1.10 / 4.x < 4.0.4 Multiple Command Injections	critical
72818	Palo Alto Networks PAN-OS 3.1.10 / 4.x < 4.0.5 Multiple Command Injections	critical
72817	Palo Alto Networks PAN-OS < 4.0.8 Multiple Vulnerabilities	high

Detections

Analytics

Palo Alto Local Security Checks Family for Nessus

high

medium

high

critical

medium

high

critical

medium

critical

medium

low

low

medium

low

low

medium

critical

high

high

medium

high

high

critical

critical

high