CVE-2019-1579 : Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

Published 2019-07-19 22:15:12

Updated 2024-07-24 16:58:15

Source Palo Alto Networks, Inc.

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2019-1579

Paloaltonetworks » Pan-os
Versions from including (>=) 8.0.0 and before (<) 8.0.12
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
Matching versions
Paloaltonetworks » Pan-os
Versions from including (>=) 8.1.0 and before (<) 8.1.3
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
Matching versions
Paloaltonetworks » Pan-os
Versions before (<) 7.1.19
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
Matching versions

CVE-2019-1579 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2019-1579

Added on 2022-01-10 Action due date 2022-07-10

Exploit prediction scoring system (EPSS) score for CVE-2019-1579

EPSS FAQ

96.77%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-1579

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.1	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST	2024-07-24
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-1579

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-1579

http://www.securityfocus.com/bid/109310

Palo Alto Networks PAN-OS CVE-2019-1579 Multiple Remote Code Execution Vulnerabilities
Broken Link;Third Party Advisory;VDB Entry
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010

SonicWall Security Advisory
Third Party Advisory

CVEs referencing this url
https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/

Attacking SSL VPN - Part 1: PreAuth RCE on Palo Alto GlobalProtect, with Uber as Case Study! | DEVCORE
Exploit;Third Party Advisory
https://security.paloaltonetworks.com/CVE-2019-1579

CVE-2019-1579 Remote Code Execution in GlobalProtect Portal/Gateway Interface
Vendor Advisory