SoylentNews

Freeman [soylentnews.org] writes:

https://arstechnica.com/information-technology/2020/06/foreign-adversaries-likely-to-exploit-critical-networking-bug-us-gov-says/ [arstechnica.com]

Foreign hackers backed by a well-resourced government are likely to exploit a critical vulnerability in a host and VPN and firewall products sold by Palo Alto Networks, officials in the US federal government warned on Tuesday.

In worst-case scenarios, the security vendor said in a post [paloaltonetworks.com], the flaw allows unauthorized people to log in to networks as administrators. With those privileges, attackers could install software of their choice or carry out other malicious actions that have serious consequences. The vulnerability, tracked as CVE-2020-2021, can be exploited when an authentication mechanism known as Security Assertion Markup Language is used to validate that users gave the proper permission to access a network. Attackers must also have Internet access to an affected server.
[...]
The vulnerability can be exploited only when authentication is enabled and the validate identity provider certificate option is disabled. In that case, the affected Palo Networks products fail to properly verify signatures. The failure is the result of flaws in PAN-OS SAML. Vulnerable releases are PAN-OS 9.1, PAN-OS 9.0 earlier then 9.0.9, PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0. PAN-OS 7.1 is unaffected.

Original Submission