cve-2020-1976
Vulnerability from cvelistv5
Published
2020-02-12 22:57
Modified
2024-09-17 01:51
Severity ?
EPSS score ?
Summary
A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS.
References
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Palo Alto Networks | GlobalProtect |
Version: 5.0 < |
|
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T06:54:00.347Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://security.paloaltonetworks.com/CVE-2020-1976", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { platforms: [ "Mac OS", ], product: "GlobalProtect", vendor: "Palo Alto Networks", versions: [ { changes: [ { at: "5.0.6", status: "unaffected", }, ], lessThanOrEqual: "5.0.5", status: "affected", version: "5.0", versionType: "custom", }, ], }, ], credits: [ { lang: "en", value: "This issue was discovered during a security test performed in collaboration with IOActive.", }, ], datePublic: "2020-02-12T00:00:00", descriptions: [ { lang: "en", value: "A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 4.7, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-642", description: "CWE-642 External Control of Critical State Data", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2020-02-12T22:57:08", orgId: "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", shortName: "palo_alto", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://security.paloaltonetworks.com/CVE-2020-1976", }, ], solutions: [ { lang: "en", value: "This issue is fixed in GlobalProtect 5.0.6, GlobalProtect 5.1.0, and all later versions.", }, ], source: { defect: [ "GPC-9616", ], discovery: "INTERNAL", }, title: "GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability.", workarounds: [ { lang: "en", value: "n/a", }, ], x_generator: { engine: "Vulnogram 0.0.9", }, x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "psirt@paloaltonetworks.com", DATE_PUBLIC: "2020-02-12T17:00:00.000Z", ID: "CVE-2020-1976", STATE: "PUBLIC", TITLE: "GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability.", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "GlobalProtect", version: { version_data: [ { platform: "Mac OS", version_affected: "<=", version_name: "5.0", version_value: "5.0.5", }, { platform: "Mac OS", version_affected: "!>=", version_name: "5.0", version_value: "5.0.6", }, ], }, }, ], }, vendor_name: "Palo Alto Networks", }, ], }, }, credit: [ { lang: "eng", value: "This issue was discovered during a security test performed in collaboration with IOActive.", }, ], data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS.", }, ], }, generator: { engine: "Vulnogram 0.0.9", }, impact: { cvss: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 4.7, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-642 External Control of Critical State Data", }, ], }, ], }, references: { reference_data: [ { name: "https://security.paloaltonetworks.com/CVE-2020-1976", refsource: "MISC", url: "https://security.paloaltonetworks.com/CVE-2020-1976", }, ], }, solution: [ { lang: "en", value: "This issue is fixed in GlobalProtect 5.0.6, GlobalProtect 5.1.0, and all later versions.", }, ], source: { defect: [ "GPC-9616", ], discovery: "INTERNAL", }, work_around: [ { lang: "en", value: "n/a", }, ], }, }, }, cveMetadata: { assignerOrgId: "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", assignerShortName: "palo_alto", cveId: "CVE-2020-1976", datePublished: "2020-02-12T22:57:08.144091Z", dateReserved: "2019-12-04T00:00:00", dateUpdated: "2024-09-17T01:51:07.142Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { fkie_nvd: { configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*\", \"versionStartIncluding\": \"5.0\", \"versionEndIncluding\": \"5.0.5\", \"matchCriteriaId\": \"5FD4E490-E203-44CC-87F7-E1871B1A9A09\"}]}]}]", descriptions: "[{\"lang\": \"en\", \"value\": \"A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad de denegaci\\u00f3n de servicio (DoS) en el software GlobalProtect de Palo Alto Networks ejecut\\u00e1ndose en Mac OS permite a usuarios locales autenticados causar la suspensi\\u00f3n o bloqueo del kernel de Mac OS. Este problema afecta a GlobalProtect versi\\u00f3n 5.0.5 y anteriores de GlobalProtect versi\\u00f3n 5.0 en Mac OS.\"}]", id: "CVE-2020-1976", lastModified: "2024-11-21T05:11:46.160", metrics: "{\"cvssMetricV31\": [{\"source\": \"psirt@paloaltonetworks.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:N/I:N/A:C\", \"baseScore\": 4.9, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 3.9, \"impactScore\": 6.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}", published: "2020-02-12T23:15:11.500", references: "[{\"url\": \"https://security.paloaltonetworks.com/CVE-2020-1976\", \"source\": \"psirt@paloaltonetworks.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://security.paloaltonetworks.com/CVE-2020-1976\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]", sourceIdentifier: "psirt@paloaltonetworks.com", vulnStatus: "Modified", weaknesses: "[{\"source\": \"psirt@paloaltonetworks.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-642\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]", }, nvd: "{\"cve\":{\"id\":\"CVE-2020-1976\",\"sourceIdentifier\":\"psirt@paloaltonetworks.com\",\"published\":\"2020-02-12T23:15:11.500\",\"lastModified\":\"2024-11-21T05:11:46.160\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de denegación de servicio (DoS) en el software GlobalProtect de Palo Alto Networks ejecutándose en Mac OS permite a usuarios locales autenticados causar la suspensión o bloqueo del kernel de Mac OS. Este problema afecta a GlobalProtect versión 5.0.5 y anteriores de GlobalProtect versión 5.0 en Mac OS.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@paloaltonetworks.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:N/A:C\",\"baseScore\":4.9,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"psirt@paloaltonetworks.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-642\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*\",\"versionStartIncluding\":\"5.0\",\"versionEndIncluding\":\"5.0.5\",\"matchCriteriaId\":\"5FD4E490-E203-44CC-87F7-E1871B1A9A09\"}]}]}],\"references\":[{\"url\":\"https://security.paloaltonetworks.com/CVE-2020-1976\",\"source\":\"psirt@paloaltonetworks.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.paloaltonetworks.com/CVE-2020-1976\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}", }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.