Brute force attack on the PAN-OS GlobalProtect external interface (PAN-SA-2017-0014)

Last revised: 04/28/2017

Summary

A vulnerability exists in PAN-OS’s GlobalProtect external interface that could allow for an attacker to brute force a username on PAN-OS GlobalProtect external Interface. The vulnerability is caused by PAN-OS provided different responses when supplying login credentials. (Ref # PAN-72769 / CVE-2017-7945)

Severity: Medium

Successful exploitation of this issue may allow a malicious user to conduct a brute force attack against PAN-OS GlobalProtect external interface.

Products Affected

PAN-OS 6.1.16 and earlier, PAN-OS 7.0.14 and earlier, PAN-OS 7.1.8 and earlier, PAN-OS 8.0.1 and earlier

Available Updates

PAN-OS 6.1.17 and later, PAN-OS 7.0.15 and later, PAN-OS 7.1.9 and later, PAN-OS 8.0.2 and later

Workarounds and Mitigations

Customers that have not configured GlobalProtect are not affected by this issue.

Acknowledgements

Palo Alto Networks would like to thank Rich Hansen from Plexus for reporting this issue to us.