CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1581 – PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface
https://notcve.org/view.php?id=CVE-2019-1581
A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4. Una vulnerabilidad de ejecución remota de código en la interfaz de administración de dispositivos SSH de PAN-OS que puede conducir a usuarios remotos no autenticados con acceso de red a la interfaz de administración SSH que obtienen acceso raíz a PAN-OS. Este problema afecta a las versiones de PAN-OS 7.1 anteriores a la versión 7.1.24-h1, 7.1.25; 8.0 versiones anteriores a la versión 8.0.19-h1, 8.0.20; 8.1 versiones anteriores a la versión 8.1.9-h4, 8.1.10; 9.0 versiones anteriores a la versión 9.0.3-h3, 9.0.4. • https://security.paloaltonetworks.com/CVE-2019-1581 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1580
https://notcve.org/view.php?id=CVE-2019-1580
Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to craft a message to Secure Shell Daemon (SSHD) and corrupt arbitrary memory. La corrupción de la memoria en PAN-OS 7.1.24 y anteriores, PAN-OS 8.0.19 y anteriores, PAN-OS 8.1.9 y anteriores, y PAN-OS 9.0.3 y anteriores permitirá que un usuario remoto no autenticado elabore un mensaje para proteger Shell Daemon (SSHD) y corromper la memoria arbitraria. • https://security.paloaltonetworks.com/CVE-2019-1580 • CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 96%CPEs: 3EXPL: 3CVE-2019-1579 – Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-1579
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code. La ejecución de código remota en PAN-OS versión 7.1.18 y anteriores, PAN-OS versión 8.0.11-h1 y anteriores, y PAN-OS versión 8.1.2 y anteriores con GlobalProtect Portal o GlobalProtect Gateway Interface habilitados pueden permitir que un atacante remoto no autenticado ejecute código arbitrario. Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. • https://github.com/securifera/CVE-2019-1579 https://github.com/Elsfa7-110/CVE-2019-1579 http://www.securityfocus.com/bid/109310 https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 https://security.paloaltonetworks.com/CVE-2019-1579 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-1575
https://notcve.org/view.php?id=CVE-2019-1575
Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API (in PAN-OS) and possibly escalate privileges granted to them. Una divulgación de información en PAN-OS versiones 7.1.23 y anteriores, PAN-OS versiones 8.0.18 y anteriores, PAN-OS versiones 8.1.8-h4 y anteriores, y PAN-OS versiones 9.0.2 y anteriores, pueden permitir que un usuario autenticado con privilegio de solo lectura para extraer la clave de la API del dispositivo y/o el nombre de usuario y contraseña de la API XML (en PAN-OS) y, posiblemente, escalar los privilegios que se les otorgan. • http://www.securityfocus.com/bid/109176 https://security.paloaltonetworks.com/CVE-2019-1575 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 1%CPEs: 180EXPL: 0CVE-2019-1559 – 0-byte record padding oracle
https://notcve.org/view.php?id=CVE-2019-1559
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html http://www.securityfocus.com/bid/107174 https://access. • CWE-203: Observable Discrepancy CWE-325: Missing Cryptographic Step •