Palo Alto Networks Security Advisories / CVE-2020-2016

CVE-2020-2016 PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation

047910
Severity 7 · HIGH
Attack Vector LOCAL
Attack Complexity HIGH
Privileges Required LOW
User Interaction NONE
Scope UNCHANGED
Confidentiality Impact HIGH
Integrity Impact HIGH
Availability Impact HIGH

Description

A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account.

This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root user.

This issue affects:

PAN-OS 7.1 versions earlier than 7.1.26;

PAN-OS 8.1 versions earlier than 8.1.13;

PAN-OS 9.0 versions earlier than 9.0.6;

All versions of PAN-OS 8.0.

Product Status

PAN-OS

VersionsAffectedUnaffected
9.1>= 9.1.0
9.0< 9.0.6>= 9.0.6
8.1< 8.1.13>= 8.1.13
8.08.0.*
7.1< 7.1.26>= 7.1.26

Severity: HIGH

CVSSv3.1 Base Score: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness Type

CWE-377 Insecure Temporary File

Solution

This issue is fixed in PAN-OS 7.1.26, PAN-OS 8.1.13, PAN-OS 9.0.6, PAN-OS 9.1.0, and all later PAN-OS versions.

PAN-OS 8.0 is now end-of-life as of October 31, 2019, and is no longer covered by our Product Security Assurance policies.

Workarounds and Mitigations

This issue affects the management interface of PAN-OS and is strongly mitigated by following best practices for securing the PAN-OS management interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation, available at: https://docs.paloaltonetworks.com.

Acknowledgments

Palo Alto Networks thanks the UK's National Cyber Security Centre (NCSC) for discovering and reporting this issue.
Palo Alto Networks thanks the NCC Group for finding this issue independently during a contracted PAN-OS security assessment.

Timeline

Initial publication
© 2020 Palo Alto Networks, Inc. All rights reserved.