The following versions of Palo Alto PAN-OS are vulnerable Successful exploitation of this vulnerability may result in the complete compromise of an unpatched system. A remote attacker can send specially crafted requests to the system, trigger memory corruption and execute arbitrary code with root privileges. The software vulnerability allows a remote attacker to execute arbitrary code on the target system and exists due to a boundary error in the PAN-OS GlobalProtect Clientless VPN during SAML authentication. This type of flaw is also known to be popularly sought out amongst cybercriminals. By overflowing (overloading) the memory buffer, a remote attacker can then execute malicious code.

The advisory confirms that a memory corruption vulnerability, “enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication.” A buffer overflow vulnerability is one of the most common types of security flaws afflicting both legacy and new products in the software industry. The Palo Alto Networks Security Advisory concerning CVE-2021-3056 in PAN-OS is a Buffer overflow security flaw that is one of the common software vulnerabilities affecting many others. Palo Alto Networks states that its GlobalProtect Clientless VPN, “is useful when you need to enable partner or contractor access to applications, and safely enable unmanaged assets, including personal endpoints.” It is a cross-platform, multi-browser enterprise security solution. A clientless secure SSL VPN (Virtual Private Network) does not require an application to function. GlobalProtect Clientless VPN is Palo Alto Networks’ secure remote access solution for enterprise web applications. This means that a large number of enterprise customers and clients can potentially be breached or compromised by a remote attacker if they do not update to the latest patch.

The successful exploitation of a vulnerability like this can potentially lead to the complete compromise of an unpatched system running the GlobalProtect Clientless VPN application. Software vulnerabilities affecting network companies are not uncommon and are usually patched quickly to avoid compromising the substantial business customer base. Specifically, it is the PAN-OS GlobalProtect Clientless VPN system. A November 10th, 2021 Security Advisory released by Palo Alto Networks revealed that a high severity software vulnerability is affecting a Palo Alto Networks enterprise product.

Globalprotect saml