Palo Alto Networks PAN-OS XML API Key Security Bypass Vulnerability

Bugtraq ID:	65886
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 29 2014 12:00AM
Updated:	Jan 29 2014 12:00AM
Credit:	Anton Ziukin, Check Point Vulnerability Research Team
Vulnerable:	Paloaltonetworks PAN-OS 5.1.3 Paloaltonetworks PAN-OS 5.1.2 Paloaltonetworks PAN-OS 5.1.1 Paloaltonetworks PAN-OS 5.0.9 Paloaltonetworks PAN-OS 5.0.8 Paloaltonetworks PAN-OS 5.0.7 Paloaltonetworks PAN-OS 5.0.6 Paloaltonetworks PAN-OS 5.0.5 Paloaltonetworks PAN-OS 5.0.4 Paloaltonetworks PAN-OS 5.0.3 Paloaltonetworks PAN-OS 4.1.15 Paloaltonetworks PAN-OS 4.1.14 Paloaltonetworks PAN-OS 4.1.13 Paloaltonetworks PAN-OS 4.1.12 Paloaltonetworks PAN-OS 4.1.4 Paloaltonetworks PAN-OS 4.1.3 Paloaltonetworks PAN-OS 4.1.2 Paloaltonetworks PAN-OS 4.1.1 Paloaltonetworks PAN-OS 5.1.4 Paloaltonetworks PAN-OS 5.0.2 Paloaltonetworks PAN-OS 5.0.1 Paloaltonetworks PAN-OS 4.1.11
Not Vulnerable:	Paloaltonetworks PAN-OS 5.0.10 Paloaltonetworks PAN-OS 4.1.16 Paloaltonetworks PAN-OS 5.1.5

Palo Alto Networks PAN-OS XML API Key Security Bypass Vulnerability

Palo Alto Networks PAN-OS is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass security restrictions to perform unauthorized actions; this may aid in launching further attacks.

This issue is fixed in PAN-OS 4.1.16, 5.0.10 and 5.1.5

Palo Alto Networks PAN-OS XML API Key Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Palo Alto Networks PAN-OS XML API Key Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Palo Alto Networks PAN-OS XML API Key Security Bypass Vulnerability

References:

• Palo Alto Networks Homepage (Palo Alto Networks)
  
• Management API Key Bypass (PAN-SA-2014-0001) (paloaltonetworks)