Palo Alto Networks Security Advisories / CVE-2016-3657

CVE-2016-3657 Unauthenticated Buffer Overflow in GlobalProtect/SSL VPN Web Interface

Severity 9.8 · CRITICAL
Attack Vector NETWORK
Attack Complexity LOW
Confidentiality Impact HIGH
Privileges Required NONE
Integrity Impact HIGH
User Interaction NONE
Availability Impact HIGH


When a PAN-OS device is configured as a GlobalProtect portal, a vulnerability exists where an improper handling of a buffer involved in the processing of SSL VPN requests can result in device crash and possible remote code execution. (Ref. #89752) (CVE-2016-3657)

An attacker with network access to the vulnerable GlobalProtect portal may be able to perform a denial-of-service (DoS) attack on the device, and may be able to perform remote code execution on the affected device.

This issue affects PAN-OS releases 5.0.17 and prior; 6.0.12 and prior; 6.1.9 and prior; 7.0.4 and prior

Product Status

PAN-OS 7.0<= 7.0.4>= 7.0.5
PAN-OS 6.1<= 6.1.9>= 6.1.10
PAN-OS 6.0<= 6.0.12>= 6.0.13
PAN-OS 5.0<= 5.0.17>= 5.0.18


CVSSv3.1 Base Score:9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness Type

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer


PAN-OS releases 5.0.18 and newer; 6.0.13 and newer; 6.1.10 and newer; 7.0.5 and newer

Workarounds and Mitigations

Emergency content update 563 contains an IPS signature (#38902) that can be used as an interim mitigation to protect PAN-OS devices until the device software is upgraded. Note that signatures 38902 must be applied to a firewall rule securing traffic destined for the GlobalProtect portal. The GlobalProtect portal should only be present once per installation, limiting the organization’s exposure to this issue. This issue can be further mitigated by disabling the affected optional “login page” in the GlobalProtect portal configuration, and distribution of the client side software may be performed through alternative means such as GPO or network share while the PAN-OS patch is applied.


Felix Wilhelm, ERNW Research
© 2023 Palo Alto Networks, Inc. All rights reserved.