CVE-2017-7945 Brute force attack on the PAN-OS GlobalProtect external interface

Palo Alto Networks Security Advisories / CVE-2017-7945

CVE-2017-7945 Brute force attack on the PAN-OS GlobalProtect external interface

Severity 9.8 · CRITICAL

Attack Vector NETWORK

Scope UNCHANGED

Attack Complexity LOW

Confidentiality Impact HIGH

Privileges Required NONE

Integrity Impact HIGH

User Interaction NONE

Availability Impact HIGH

CVE JSON

Published 2017-04-28

Updated 2017-04-28

Reference PAN-72769, PAN-SA-2017-0014

Description

A vulnerability exists in the PAN-OS GlobalProtect external interface that could allow for an attacker to brute force a username on PAN-OS GlobalProtect external Interface. The vulnerability is caused by PAN-OS provided different responses when supplying login credentials. (Ref # PAN-72769 / CVE-2017-7945)

Successful exploitation of this issue may allow a malicious user to conduct a brute force attack against PAN-OS GlobalProtect external interface.

This issue affects PAN-OS 6.1.16 and earlier, PAN-OS 7.0.14 and earlier, PAN-OS 7.1.8 and earlier, PAN-OS 8.0.1 and earlier

Product Status

Versions	Affected	Unaffected
PAN-OS 8.0	<= 8.0.1	>= 8.0.2
PAN-OS 7.1	<= 7.1.8	>= 7.1.9
PAN-OS 7.0	<= 7.0.14	>= 7.0.15
PAN-OS 6.1	<= 6.1.16	>= 6.1.17

Severity: CRITICAL

CVSSv3.0 Base Score: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness Type

CWE-209 Information Exposure Through an Error Message

Solution

PAN-OS 6.1.17 and later, PAN-OS 7.0.15 and later, PAN-OS 7.1.9 and later, PAN-OS 8.0.2 and later

Workarounds and Mitigations

Customers that have not configured GlobalProtect are not affected by this issue.

Acknowledgments

Palo Alto Networks would like to thank Rich Hansen from Plexus for reporting this issue to us.