Lucene search

Palo Alto Networks Product Security Incident Response TeamPAN-SA-2017-0002

HistoryJan 26, 2017 - 6:31 p.m.

Spoofing in Terminal Server Agent

2017-01-2618:31:00

Palo Alto Networks Product Security Incident Response Team

securityadvisories.paloaltonetworks.com

498

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

49.3%

JSON

A spoofing vulnerability exists in Terminal Server Agent (ref # PAN-67269 / CVE-2017-5328).
Terminal Server Agent contains a vulnerability whereby a user can spoof the identity of another authenticated user.
This issue affects Terminal Server Agent 6.0; Terminal Server Agent 7.0.6 and earlier

Work around:
N/A

Affected configurations

Vulners

Node

softwareterminal_server_agentRange≤7.0.6

VendorProductVersionCPE
softwareterminal_server_agent*cpe:2.3:a:software:terminal_server_agent:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
software	terminal_server_agent	*	cpe:2.3:a:software:terminal_server_agent::::::::

References

security.paloaltonetworks.com/CVE-2017-5328

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

49.3%

JSON

Related for PAN-SA-2017-0002