Updated Palo Alto Networks (PAN) has issued a patch for a CVSS 9.8-rated buffer overflow affecting a VPN component of its widely used firewall software, warning that the flaw allows unauthenticated attackers to execute arbitrary code on unpatched appliances.
While the current version, 10.1, and three before it are not affected, the vuln, tracked as CVE-2021-3064, still exists in version 8.1.17 and all previous versions of PAN-OS, PAN's firewall operating system.
"A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges," said the company in an advisory published this week.
"The attacker must have network access to the GlobalProtect interface to exploit this issue."
The flaw was found by infosec outfit Randori, which warned that around 10,000 vulnerable firewalls were viewable across the wider internet earlier this week.
Such vulns are rapidly picked up on and exploited by ransomware gangs and nation states; Australia's Cyber Security Centre issued a warning today urging sysadmins to "apply the available update as soon as possible."
Randori summarised the vuln by saying: "The vulnerability chain consists of a method for bypassing validations made by an external web server (HTTP smuggling) and a stack-based buffer overflow."
No exploit has yet been seen in the wild but exploitation is only a matter of time, judging by previous experience.
- Stob treks back across the decades to review the greatest TV sci-fi in the light of recent experience
- If you haven't potentially exposed 1000s of customers once again with networking vulns, step forward... Not so fast, Palo Alto Networks
- Let us give thanks that this November, Microsoft has given us just 55 security fixes, two of which are for actively exploited flaws
- Will they try it for 30 days first? McAfee goes private again in $14bn cash deal
- Emails, chat logs, more leaked online from far-right militia linked to US Capitol riot
Furious Reg reader John complained: "Everybody using Palo Alto Networks' GlobalProtect, who is running only the second newest patch level on the 8.1 train which is still active in the lifecycle, is affected."
He added: "Memory corruption, really? There are enough code checking tools available which would help the developers to spot this before rolling the product…"
We have asked PAN for comment and will update this article if the firm responds. Earlier this year the company spent $156m buying an open source code-checking company: DevSecOps outfit Bridgecrew.
"Prisma Cloud customers will benefit from a single platform that will deliver cloud security from build time to runtime, seamlessly connecting security and DevOps teams," burbled PAN at the time.
Perhaps that Checkov tool ought to be directed inwards as well as outwards. ®
Updated at 1741 UTC on 11 November to add
Palo Alto Network sent us a statement following publication of this article:
The security advisory released addresses a vulnerability that may impact customers using old versions of PAN-OS (8.1.16 and earlier). We took immediate steps to implement mitigations. As outlined in the security advisory, we are not aware of any malicious attempts to exploit the vulnerability. We strongly encourage following best practices to keep systems updated and thank the researchers for alerting us and sharing their findings.