CVE-2016-5696 Kernel Vulnerability

Palo Alto Networks Security Advisories / CVE-2016-5696

CVE-2016-5696 Kernel Vulnerability

Severity 4.8 · MEDIUM

Attack Vector NETWORK

Scope UNCHANGED

Attack Complexity HIGH

Confidentiality Impact NONE

Privileges Required NONE

Integrity Impact LOW

User Interaction NONE

Availability Impact LOW

CVE JSON

Published 2017-05-23

Updated 2017-05-23

Reference PAN-62500, PAN-SA-2017-0015

Description

A vulnerability exists in the kernel of PAN-OS that may result in Information Disclosure. The challenge ACK rate limiting in the kernel's networking subsystem may allow an off-path attacker to leak certain information about a given connection by creating congestion on the global challenge ACK rate limit counter and then measuring the changes by probing packets. (ref # PAN-62500 / CVE-2016-5696).

Successful exploitation of this issue may allow an attacker to terminate a TCP connection or inject a payload into non-secured TCP connection between two endpoints on the network.

This issue affects PAN-OS 6.1, PAN-OS 7.0.15 and earlier, PAN-OS 7.1.9 and earlier

Product Status

Versions	Affected	Unaffected
PAN-OS 7.1	<= 7.1.9	>= 7.1.10
PAN-OS 7.0	<= 7.0.15	>= 7.0.16
PAN-OS 6.1	6.1.*	None

Severity: MEDIUM

CVSSv3.1 Base Score: 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)

Weakness Type

CWE-200 Information Exposure

Solution

PAN-OS 7.0.16 and later, PAN-OS 7.1.10 and later

Workarounds and Mitigations

N/A