Palo Alto Networks Global Protect Client CVE-2019-1573 Local Information Disclosure Vulnerability

Bugtraq ID:	107868
Class:	Design Error
CVE:	CVE-2019-1573
Remote:	No
Local:	Yes
Published:	Apr 09 2019 12:00AM
Updated:	Apr 23 2019 07:00AM
Credit:	National Defense ISAC Remote Access
Vulnerable:	Paloaltonetworks GlobalProtect Agent 4.1.10 Paloaltonetworks GlobalProtect Agent 4.1
Not Vulnerable:	Paloaltonetworks GlobalProtect Agent 4.1.11 Paloaltonetworks GlobalProtect Agent 4.1.1

Palo Alto Networks Global Protect Client CVE-2019-1573 Local Information Disclosure Vulnerability

Palo Alto Networks Global Protect Client is prone to a local information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

Versions prior to Palo Alto Networks Global Protect Client 4.1.11 for macOS and 4.1.10 for Windows are vulnerable.

Palo Alto Networks Global Protect Client CVE-2019-1573 Local Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Palo Alto Networks Global Protect Client CVE-2019-1573 Local Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Palo Alto Networks Global Protect Client CVE-2019-1573 Local Information Disclosure Vulnerability

References:

• Palo Alto Networks Homepage (Palo Alto Networks)
  
• BSA-2019-783 (Broadcom)
  
• Information Disclosure in GlobalProtect Agent (PAN-SA-2019-0008) (Palo Alto Networks)
  
• Multiple VPN applications insecurely store session cookies (CERT)