Workaound for PAN-OS: Predictable temporary file vulnerability

Deepak_K — Sat, 30 May 2020 10:21:25 GMT

There is no workaround available for this vulnerability

https://security.paloaltonetworks.com/CVE-2020-1981

A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation.

This issue allows a local attacker who bypassed the restricted shell to execute commands as a low privileged user and gain root access on the PAN-OS hardware or virtual appliance.

We don't want to upgrade software to resolve this issue.

Can we create password profile as workaround for this vulnerability point ? or please suggest any other alternative.

Re: Workaound for PAN-OS: Predictable temporary file vulnerability

BPry — Mon, 01 Jun 2020 02:39:21 GMT

@Deepak_K,

The vulnerability by itself really wouldn't be something that I would worry about, because you need to actually get direct shell access to the device in order to take advantage of it. PAN-OS already doesn't give a user direct shell access even when authenticated.

In short, to take advantage of this vulnerability the attacker would need to:

1) Gain administrative access to the device.

- You hopefully already have this secured by permitted-ips so they would first need to compromise the proper internal machines.

2) Gain direct shell access.

- There are other vulnerabilities that have allowed unrestricted shell access, you'll want to see if any of them actually effect your current PAN-OS release.

3) Lastly exploit this vulnerability to actually gain root access on the underlying operating system.

The risk of exploit here is relatively low, and properly securing your management access is going to negate most concern I would ever have of real world exploit. Part of proper management security would be ensuring that admins have a proper password on their account, so I would recommend setting up a good password policy if you aren't already enforcing one.

topic Re: Workaound for PAN-OS: Predictable temporary file vulnerability in General Topics

Workaound for PAN-OS: Predictable temporary file vulnerability

Re: Workaound for PAN-OS: Predictable temporary file vulnerability