By 
A serious remote code execution flaw has been discovered and patched in Palo Alto Networks’ GlobalProtect product.
Last week, Palo Alto Networks published an advisory after researchers Orange Tsai and Meh Chang published a blog post mentioning the susceptibility. The researchers also issued proof-of-concept (PoC) code and offered a command that can be used to recognize susceptible installations.
The vulnerability, according to the vendor’s advisory, was tracked as CVE-2019-1579, and impacts the GlobalProtect portal and GlobalProtect Gateway interface products. It also enables an unverified attacker to remotely perform random code.
The affected GlobalProtect products offer companies virtual private network (VPN) access and other security and management features for their mobile workforce.
The security hole was patched with the release of PAN-OS versions 7.1.19, 8.0.12 and 8.1.3. Earlier versions are impacted.
Researchers at Tenable have also evaluated CVE-2019-1579 and stated it as a “format string vulnerability in the PAN SSL Gateway, which handles client/server SSL handshakes.”
“More specifically, the vulnerability exists because the gateway passes the value of a particular parameter to snprintf in an unsanitized, and exploitable, fashion. An unauthenticated attacker could exploit the vulnerability by sending a specially crafted request to a vulnerable SSL VPN target in order to remotely execute code on the system,” Tenable’s Satnam Narang said in a blog post.
Orange Tsai and Meh Chang said they reported their results to Palo Alto Networks, but the vendor told them that it had revealed the fault internally and issued a patch before the researchers reached out.
The experts established that the latest versions of the product are not affected. Nevertheless, they decided to search the web for main organizations that might still be using the susceptible versions of GlobalProtect and observed that Uber had 22 servers running it for VPN access.
