High vulnerabilities PAN-OS reported by vulnerability management scan

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

High vulnerabilities PAN-OS reported by vulnerability management scan

L4 Transporter

Hello colleagues:

 

Good afternoon, hope you are all well.

 

Some of you have reported these critical vulnerabilities to them, by Nesus Scan:

 

Protocol Port Name Synopsis Description Solution
TCP 443 CGI Generic Command Execution (time-based) It may be possible to run arbitrary code on the remote web server. The remote web server hosts CGI scripts that fail to adequately sanitize request strings.  By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host.

Note that this script uses a time-based detection method which is less reliable than the basic method.
Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade.
TCP 443 CGI Generic SQL Injection (blind, time based) A CGI application hosted on the remote web server is potentially prone to SQL injection attack. By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database.

An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system.

Note that this script is experimental and may be prone to false positives.
Modify the affected CGI scripts so that they properly escape arguments.

 

Do you know if these two are false positives, if they can be mitigated with an adjustment or by performing an upgrade?

 

This was reported on PAN-OS 9.1.4 platform.

 

I remain attentive to your comments and suggestions

 

Thanks

 

Best regards

 

 

High Sticker
1 REPLY 1

Cyber Elite
Cyber Elite

Hello,

I would recommend you upgrade the code version.

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-...

 

Regards,

  • 1974 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!