CVE-2020-2016
High
Description
A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All versions of PAN-OS 8.0.
SeverityHigh
CVSS7.0
Exploit probability—
Product
Paloaltonetworks Pan-os
PublishedMay 13, 2020
First seenMay 13, 2020
Weakness typeCWE-377CWE-377
How to fix
Update
- paloaltonetworks pan-os7.1.26, 8.1.13, 9.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| paloaltonetworks pan-os | 7.1.0 ≤ v < 7.1.26, 8.0.0 ≤ v ≤ 8.0.20, 8.1.0 ≤ v < 8.1.13, 9.0.0 ≤ v < 9.0.6 | 7.1.26, 8.1.13, 9.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.