Vulnerabilities > CVE-2012-6596 - Credentials Management vulnerability in Paloaltonetworks Pan-Os

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
paloaltonetworks
CWE-255
nessus

Summary

Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.3 stores cleartext LDAP bind passwords in authd.log, which allows context-dependent attackers to obtain sensitive information by reading this file, aka Ref ID 35493.

Common Weakness Enumeration (CWE)

Nessus

NASL familyPalo Alto Local Security Checks
NASL idPALO_ALTO_PAN-SA-2012-0007.NASL
descriptionThe remote host is running a version of Palo Alto Networks PAN-OS prior to 4.0.9 / 4.1.3. It is, therefore, affected by an information disclosure vulnerability due to LDAP bind passwords being logged in plaintext when using default logging settings. Note that the 3.1 branch is not affected by this vulnerability.
last seen2020-06-01
modified2020-06-02
plugin id72822
published2014-03-05
reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/72822
titlePalo Alto Networks PAN-OS < 4.0.9 / 4.1.x < 4.1.3 Information Disclosure
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(72822);
  script_version("1.7");
  script_cvs_date("Date: 2018/07/24 18:56:13");

  script_cve_id("CVE-2012-6596");
  script_bugtraq_id(62132);

  script_name(english:"Palo Alto Networks PAN-OS < 4.0.9 / 4.1.x < 4.1.3 Information Disclosure");
  script_summary(english:"Checks the PAN-OS version.");

  script_set_attribute(
    attribute:"synopsis",
    value:
"The remote host is affected by an information disclosure
vulnerability."
  );
  script_set_attribute(
    attribute:"description",
    value:
"The remote host is running a version of Palo Alto Networks PAN-OS
prior to 4.0.9 / 4.1.3. It is, therefore, affected by an information
disclosure vulnerability due to LDAP bind passwords being logged in
plaintext when using default logging settings.

Note that the 3.1 branch is not affected by this vulnerability."
  );
  script_set_attribute(attribute:"see_also", value:"https://securityadvisories.paloaltonetworks.com/Home/Detail/7");
  script_set_attribute(attribute:"solution", value:"Upgrade to PAN-OS version 4.0.9 / 4.1.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/01/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/03/05");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:paloaltonetworks:pan-os");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Palo Alto Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");

  script_dependencies("palo_alto_version.nbin");
  script_require_keys("Host/Palo_Alto/Firewall/Version", "Host/Palo_Alto/Firewall/Full_Version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

app_name = "Palo Alto Networks PAN-OS";
version = get_kb_item_or_exit("Host/Palo_Alto/Firewall/Version");
full_version = get_kb_item_or_exit("Host/Palo_Alto/Firewall/Full_Version");
fix = NULL;

# Ensure sufficient granularity.
if (version !~ "^\d+\.\d+") audit(AUDIT_VER_NOT_GRANULAR, app_name, full_version);

# 3.0.x is not affected
if (version =~ "^3\.1($|[^0-9])") audit(AUDIT_INST_VER_NOT_VULN, app_name, full_version);

if (version =~ "^4\.1($|[^0-9])")
  fix = "4.1.3";
else
  fix = "4.0.9";

# Compare version to fix and report as needed.
if (ver_compare(ver:version, fix:fix, strict:FALSE) == -1)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Installed version : ' + full_version +
      '\n  Fixed version     : ' + fix +
      '\n';
    security_warning(extra:report, port:0);
  }
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_INST_VER_NOT_VULN, app_name, full_version);