ssa-354569
Vulnerability from csaf_siemens
Published
2024-11-22 00:00
Modified
2024-11-22 00:00
Summary
SSA-354569: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices

Notes

Summary
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.


To clipboard 

{
   document: {
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
         tlp: {
            label: "WHITE",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.\n\nSiemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available.\n\n[1]  https://security.paloaltonetworks.com/",
            title: "Summary",
         },
         {
            category: "general",
            text: "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
            title: "General Recommendations",
         },
         {
            category: "general",
            text: "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
            title: "Additional Resources",
         },
         {
            category: "legal_disclaimer",
            text: "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "productcert@siemens.com",
         name: "Siemens ProductCERT",
         namespace: "https://www.siemens.com",
      },
      references: [
         {
            category: "self",
            summary: "SSA-354569: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices - HTML Version",
            url: "https://cert-portal.siemens.com/productcert/html/ssa-354569.html",
         },
         {
            category: "self",
            summary: "SSA-354569: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices - CSAF Version",
            url: "https://cert-portal.siemens.com/productcert/csaf/ssa-354569.json",
         },
      ],
      title: "SSA-354569: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices",
      tracking: {
         current_release_date: "2024-11-22T00:00:00Z",
         generator: {
            engine: {
               name: "Siemens ProductCERT CSAF Generator",
               version: "1",
            },
         },
         id: "SSA-354569",
         initial_release_date: "2024-11-22T00:00:00Z",
         revision_history: [
            {
               date: "2024-11-22T00:00:00Z",
               legacy_version: "1.0",
               number: "1",
               summary: "Publication Date",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "vers:all/*",
                        product: {
                           name: "RUGGEDCOM APE1808",
                           product_id: "1",
                        },
                     },
                     {
                        category: "product_version_range",
                        name: "vers:all/*",
                        product: {
                           name: "RUGGEDCOM APE1808",
                           product_id: "2",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "RUGGEDCOM APE1808",
               },
            ],
            category: "vendor",
            name: "Siemens",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2024-0012",
         cwe: {
            id: "CWE-306",
            name: "Missing Authentication for Critical Function",
         },
         notes: [
            {
               category: "summary",
               text: "An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474.",
               title: "Summary",
            },
         ],
         product_status: {
            known_affected: [
               "2",
            ],
         },
         remediations: [
            {
               category: "mitigation",
               details: "Exposure can be reduced by limiting access to the management interface to trusted internal IP addresses as described in \nPalo Alto Networks' Security Advisory",
               product_ids: [
                  "2",
               ],
            },
            {
               category: "vendor_fix",
               details: "Contact customer support to receive patch and update information",
               product_ids: [
                  "2",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 10,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "2",
               ],
            },
         ],
         title: "CVE-2024-0012",
      },
      {
         cve: "CVE-2024-2550",
         cwe: {
            id: "CWE-476",
            name: "NULL Pointer Dereference",
         },
         notes: [
            {
               category: "summary",
               text: "A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the GlobalProtect service on the firewall by sending a specially crafted packet that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.",
               title: "Summary",
            },
         ],
         product_status: {
            known_affected: [
               "1",
            ],
         },
         remediations: [
            {
               category: "vendor_fix",
               details: "Contact customer support to receive patch and update information",
               product_ids: [
                  "1",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "1",
               ],
            },
         ],
         title: "CVE-2024-2550",
      },
      {
         cve: "CVE-2024-2552",
         cwe: {
            id: "CWE-22",
            name: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
         },
         notes: [
            {
               category: "summary",
               text: "A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall.",
               title: "Summary",
            },
         ],
         product_status: {
            known_affected: [
               "2",
            ],
         },
         remediations: [
            {
               category: "vendor_fix",
               details: "Contact customer support to receive patch and update information",
               product_ids: [
                  "2",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "2",
               ],
            },
         ],
         title: "CVE-2024-2552",
      },
      {
         cve: "CVE-2024-9474",
         cwe: {
            id: "CWE-78",
            name: "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
         },
         notes: [
            {
               category: "summary",
               text: "A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.",
               title: "Summary",
            },
         ],
         product_status: {
            known_affected: [
               "2",
            ],
         },
         remediations: [
            {
               category: "mitigation",
               details: "Exposure can be reduced by limiting access to the management interface to trusted internal IP addresses as described in \nPalo Alto Networks' Security Advisory",
               product_ids: [
                  "2",
               ],
            },
            {
               category: "vendor_fix",
               details: "Contact customer support to receive patch and update information",
               product_ids: [
                  "2",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "2",
               ],
            },
         ],
         title: "CVE-2024-9474",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.