topic Re: Orange attack on GP in General Topics

Orange attack on GP

Alex_Samad — Wed, 17 Jul 2019 23:32:18 GMT

https://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html?m=1

Any word from PA on this ?

Re: Orange attack on GP

BPry — Thu, 18 Jul 2019 03:20:57 GMT

What exactly were you looking for? The vulnerability was fixed last year, and anyone running a currently recommended release (or really any within the past year) wouldn't be effected by this anymore.

Re: Orange attack on GP

Alex_Samad — Thu, 18 Jul 2019 06:05:27 GMT

Oh, I have 8.1.5 and I seem to still be vulnerable.

I will patch up.

thaks

Re: Orange attack on GP

Remo — Sat, 27 Jul 2019 21:53:21 GMT

@Alex_Samad with 8.1.5 you shouln't be vulnerable.

But what Paloalto did here is a no-go. No matter if there are recommended releases and so far. Only this external discovery of the vulnerability was forcing Paloalto to go public. A security company that tries to keep secret a RCE vulnerability for more than a year ... I can't really find words about how bad this is ...

https://live.paloaltonetworks.com/t5/General-Topics/PAN-SA-2019-0020-really/m-p/278690/highlight/true#M75667