cnvd - cnvd-2021-29856

CNVD-2021-29856

Vulnerability from cnvd - Published: 2021-04-22

Title

Palo Alto Networks GlobalProtect拒绝服务漏洞

Description

Palo Alto Networks GlobalProtect是美国Palo Alto Networks公司的一套网络防护软件。该软件可提供防火墙监控及威胁预防等功能。 GlobalProtect app存在安全漏洞，该漏洞允许本地用户执行拒绝服务(DoS)攻击。目前没有详细的漏洞细节提供。

Severity

中

Patch Name

Palo Alto Networks GlobalProtect拒绝服务漏洞的补丁

Patch Description

Palo Alto Networks GlobalProtect是美国Palo Alto Networks公司的一套网络防护软件。该软件可提供防火墙监控及威胁预防等功能。 GlobalProtect app存在安全漏洞，该漏洞允许本地用户执行拒绝服务(DoS)攻击。目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://security.paloaltonetworks.com/CVE-2021-3038

Reference

https://www.cybersecurity-help.cz/vdb/SB2021041420 https://www.auscert.org.au/bulletins/ESB-2021.1270

Impacted products

Name
Palo Alto Networks GlobalProtect

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-3038"
    }
  },
  "description": "Palo Alto Networks GlobalProtect\u662f\u7f8e\u56fdPalo Alto Networks\u516c\u53f8\u7684\u4e00\u5957\u7f51\u7edc\u9632\u62a4\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u53ef\u63d0\u4f9b\u9632\u706b\u5899\u76d1\u63a7\u53ca\u5a01\u80c1\u9884\u9632\u7b49\u529f\u80fd\u3002 \n\nGlobalProtect app\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u5141\u8bb8\u672c\u5730\u7528\u6237\u6267\u884c\u62d2\u7edd\u670d\u52a1(DoS)\u653b\u51fb\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://security.paloaltonetworks.com/CVE-2021-3038",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-29856",
  "openTime": "2021-04-22",
  "patchDescription": "Palo Alto Networks GlobalProtect\u662f\u7f8e\u56fdPalo Alto Networks\u516c\u53f8\u7684\u4e00\u5957\u7f51\u7edc\u9632\u62a4\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u53ef\u63d0\u4f9b\u9632\u706b\u5899\u76d1\u63a7\u53ca\u5a01\u80c1\u9884\u9632\u7b49\u529f\u80fd\u3002 \r\n\r\nGlobalProtect app\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u5141\u8bb8\u672c\u5730\u7528\u6237\u6267\u884c\u62d2\u7edd\u670d\u52a1(DoS)\u653b\u51fb\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002 \u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Palo Alto Networks GlobalProtect\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Palo Alto Networks GlobalProtect"
  },
  "referenceLink": "https://www.cybersecurity-help.cz/vdb/SB2021041420\r\nhttps://www.auscert.org.au/bulletins/ESB-2021.1270",
  "serverity": "\u4e2d",
  "submitTime": "2021-04-19",
  "title": "Palo Alto Networks GlobalProtect\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2021-3038 (GCVE-0-2021-3038)

Vulnerability from cvelistv5 – Published: 2021-04-20 03:15 – Updated: 2024-09-16 17:49

Summary

A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.8; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.4.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-20 - Improper Input Validation
CWE-248 - Uncaught Exception

Assigner

palo_alto

References

URL

Tags

https://security.paloaltonetworks.com/CVE-2021-3038

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Palo Alto Networks	GlobalProtect App	Affected: 5.1 , < 5.1.8 (custom) Affected: 5.2 , < 5.2.4 (custom)

Credits

Palo Alto Networks thanks Christophe Schleypen from NCIA / NCIRC for discovering and reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:45:50.745Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2021-3038"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows"
          ],
          "product": "GlobalProtect App",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.1.8",
                  "status": "unaffected"
                }
              ],
              "lessThan": "5.1.8",
              "status": "affected",
              "version": "5.1",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.2.4",
                  "status": "unaffected"
                }
              ],
              "lessThan": "5.2.4",
              "status": "affected",
              "version": "5.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Palo Alto Networks thanks Christophe Schleypen from NCIA / NCIRC for discovering and reporting this issue."
        }
      ],
      "datePublic": "2021-04-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.8; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.4."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248 Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-20T03:15:18",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2021-3038"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue is fixed in GlobalProtect app 5.1.8, GlobalProtect app 5.2.4, and all later GlobalProtect app versions."
        }
      ],
      "source": {
        "defect": [
          "GPC-10983"
        ],
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2021-04-14T00:00:00",
          "value": "Initial publication"
        }
      ],
      "title": "GlobalProtect App: Windows VPN kernel driver denial of service (DoS)",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2021-04-14T16:00:00.000Z",
          "ID": "CVE-2021-3038",
          "STATE": "PUBLIC",
          "TITLE": "GlobalProtect App: Windows VPN kernel driver denial of service (DoS)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GlobalProtect App",
                      "version": {
                        "version_data": [
                          {
                            "platform": "Windows",
                            "version_affected": "\u003c",
                            "version_name": "5.1",
                            "version_value": "5.1.8"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "!\u003e=",
                            "version_name": "5.1",
                            "version_value": "5.1.8"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "\u003c",
                            "version_name": "5.2",
                            "version_value": "5.2.4"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "!\u003e=",
                            "version_name": "5.2",
                            "version_value": "5.2.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Palo Alto Networks thanks Christophe Schleypen from NCIA / NCIRC for discovering and reporting this issue."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.8; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.4."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
          }
        ],
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20 Improper Input Validation"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-248 Uncaught Exception"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.paloaltonetworks.com/CVE-2021-3038",
              "refsource": "MISC",
              "url": "https://security.paloaltonetworks.com/CVE-2021-3038"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "This issue is fixed in GlobalProtect app 5.1.8, GlobalProtect app 5.2.4, and all later GlobalProtect app versions."
          }
        ],
        "source": {
          "defect": [
            "GPC-10983"
          ],
          "discovery": "EXTERNAL"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2021-04-14T00:00:00",
            "value": "Initial publication"
          }
        ],
        "x_advisoryEoL": false,
        "x_affectedList": [
          "GlobalProtect App 5.2.3",
          "GlobalProtect App 5.2.2",
          "GlobalProtect App 5.2.1",
          "GlobalProtect App 5.2.0",
          "GlobalProtect App 5.2",
          "GlobalProtect App 5.1.7",
          "GlobalProtect App 5.1.6",
          "GlobalProtect App 5.1.5",
          "GlobalProtect App 5.1.4",
          "GlobalProtect App 5.1.3",
          "GlobalProtect App 5.1.1",
          "GlobalProtect App 5.1.0",
          "GlobalProtect App 5.1"
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2021-3038",
    "datePublished": "2021-04-20T03:15:18.565071Z",
    "dateReserved": "2021-01-06T00:00:00",
    "dateUpdated": "2024-09-16T17:49:11.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-29856

CVE-2021-3038 (GCVE-0-2021-3038)

Tags

Sightings

Nomenclature