====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN342
_____________________________________________________________________

DATE                : 12/06/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running GlobalProtect App versions prior to
                                         5.1.4, 5.0.10.

=====================================================================
https://security.paloaltonetworks.com/CVE-2020-2032
https://security.paloaltonetworks.com/CVE-2020-2033
_____________________________________________________________________

CVE-2020-2032 GlobalProtect App: File race condition vulnerability leads
to local privilege escalation during upgrade


Severity 7 ·            HIGH
Attack Vector           LOCAL
Attack Complexity       HIGH
Privileges Required     LOW
User Interaction        NONE
Scope                   UNCHANGED
Confidentiality Impact  HIGH
Integrity Impact        HIGH
Availability Impact     HIGH
NVD JSON
Published:              2020-06-10
Updated:                2020-06-10
Ref#:                   GPC-10583


Description

A race condition vulnerability Palo Alto Networks GlobalProtect app on
Windows allows a local limited Windows user to execute programs with
SYSTEM privileges.

This issue can be exploited only while performing a GlobalProtect app
upgrade.

This issue affects:

GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10 on
Windows;

GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 on
Windows.


Product Status

GlobalProtect App

Versions	Affected	Unaffected
5.1             < 5.1.4 on Windows	>= 5.1.4 on Windows
5.0             < 5.0.10 on Windows	>= 5.0.10 on Windows


Severity: HIGH

CVSSv3.1 Base Score: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)


Weakness Type

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Solution

This issue is fixed in GlobalProtect app 5.0.10, GlobalProtect app
5.1.4, and all later GlobalProtect app versions.


Workarounds and Mitigations


Acknowledgements

Palo Alto Networks thanks Rich Mirch of TeamARES from Critical Start Inc
for discovering and reporting this issue.


Timeline
2020-06-10
Initial publication

_____________________________________________________________________

CVE-2020-2033 GlobalProtect App: Missing certificate validation
vulnerability can disclose pre-logon authentication cookie


Severity 5.3 ·           MEDIUM
Attack Vector            ADJACENT_NETWORK
Attack Complexity        HIGH
Privileges Required      NONE
User Interaction         NONE
Scope                    UNCHANGED
Confidentiality Impact   HIGH
Integrity Impact         NONE
Availability Impact      NONE
NVD JSON
Published:               2020-06-10
Updated:                 2020-06-10
Ref#:                    GPC-10741


Description

When the pre-logon feature is enabled, a missing certification
validation in Palo Alto Networks GlobalProtect app can disclose the
pre-logon authentication cookie to a man-in-the-middle attacker on the
same local area network segment with the ability to manipulate ARP or to
conduct ARP spoofing attacks. This allows the attacker to access the
GlobalProtect Server as allowed by configured Security rules for the
'pre-login' user. This access may be limited compared to the network
access of regular users.

This issue affects:

GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10
when the prelogon feature is enabled;

GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 when
the prelogon feature is enabled.


Product Status

GlobalProtect App

Versions	Affected	Unaffected
5.1             < 5.1.4         >= 5.1.4
5.0             < 5.0.10        >= 5.0.10

Severity: MEDIUM

CVSSv3.1 Base Score: 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)


Weakness Type

CWE-290 Authentication Bypass by Spoofing

CWE-295 Improper Certificate Validation


Solution

This issue is fixed in GlobalProtect app 5.0.10, GlobalProtect app
5.1.4, and all later GlobalProtect app versions.


Workarounds and Mitigations

The impact of this vulnerability can be mitigated by decreasing the
allowed timeout settings for the prelogon feature or by completely
disabling the feature in the GlobalProtect gateway.


Acknowledgements

Palo Alto Networks thanks Tom Wyckhuys and Nabeel Ahmed from NTT Belgium
for discovering and reporting this issue.


Timeline
2020-06-10
Initial publication

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================