Palo Alto Networks patches serious vulnerabilities

Security vendor Palo Alto Networks has issued a security advisory covering four vulnerabilities affecting its PAN-OS operating system and is advising users to patch immediately.

Two vulnerabilities in particular appear to be particularly dangerous, according to Johannes Ullrich of security vendor SANS Institute.

Rated as "critical" by Palo Alto Networks, a buffer overflow in the PAN-OS GlobalProtect SSL VPN web interface could be abused to bypass restrictions to limit traffic to trusted IP addresses only.

"An attacker with network access to the vulnerable GlobalProtect portal may be able to perform a denial-of-service (DoS) attack on the device, and may be able to perform remote code execution on the affected device," Palo Alto Networks said.

Users can apply emergency content update 563, which contains intrusion protection system signature #38902 to their firewall rules, as a workaround to protect traffic to the GlobalProtect portal, the vendor said.

The vulnerability was discovered by Felix Wilhelm of ERNW Research.

A second vulnerability marked as "high" is found in the API for the PAN-OS management web interface and could allow attackers to execute arbitrary commands, Ullrich said.

Another IPS signature - #38904 - in emergency content update 563 can be applied to firewall rules as an interrim mitigation measure to protect devices running PAN-OS until they can be upgraded, Palo Alto Networks suggested.

PAN-OS releases 5.0.10, 5.0.17, 6.0.12, 6.1.19, 7.0.4 and prior versions are affected, the company said.