CVE-2019-1579
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
CVSS
8.1
Alto
EPSS
46.0%
p99
KEV
SÍ
10 ene 2022
Exploit Today
80
0-100
Publicado: 19 jul 2019 · Última mod.: 12 ago 2026 · CWE-134
46.0%EPSS · 30 días46.0%
2026-08-022026-08-30
Producto
Palo Alto Networks / PAN-OS
Vulnerabilidad
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Añadido a KEV
10 ene 2022
Remediar antes de
10 jul 2022
Uso conocido en ransomware
Sí
Descripción resumida
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Acción requerida
Apply updates per vendor instructions.
Notas
https://nvd.nist.gov/vuln/detail/CVE-2019-1579
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.
- www.securityfocus.comhttp://www.securityfocus.com/bid/109310
- devco.rehttps://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/
- psirt.global.sonicwall.comhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010
- security.paloaltonetworks.comhttps://security.paloaltonetworks.com/CVE-2019-1579
- www.securityfocus.comhttp://www.securityfocus.com/bid/109310
- devco.rehttps://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/
- psirt.global.sonicwall.comhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010
- security.paloaltonetworks.comhttps://security.paloaltonetworks.com/CVE-2019-1579
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1579
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-168217.0 ALT0.8%
——0IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format string vulnerability.2dCVE-2026-815748.2 ALT33.9%
——10In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format
specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory
and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and
remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this
vulnerability.3dCVE-2026-63073—34.0%
——10Issue summary: OpenSSL CMP response validation passed an unexpected response
sender distinguished name directly as the format string to `ERR_raise_data()`.
Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client
that enforces an expected sender or uses a pinned server certificate whose
subject becomes the default expected sender.
CWE: CWE-134 (Use of Externally-Controlled Format String)
Description: When validating a received CMP message, ossl_cmp_msg_check_update()
converts the peer-supplied sender distinguished name with X509_NAME_oneline()
and passes it directly as the format argument to ERR_raise_data(). Percent
characters survive the conversion, so a sender DN such as "CN=%s%n" reaches
BIO_vsnprintf() as an attacker-controlled format string with no matching variadic
arguments. This path is only reached when the caller configures an expected
sender or pins a server certificate, which is the normal configuration for a
CMP client validating server responses.
Since the attacker controls the format string but none of the variadic
arguments, such specifiers as %s and %n dereference or write through unrelated
stack contents and crash the client. The reliable consequence is a denial of
service, when the response comes from a malicious or intercepted CMP endpoint.
There is no controlled memory write, arbitrary-address read, or reliable path
to remote code execution.
FIPS impact: no
No FIPS modules are affected by this issue, as the CMP protocol
implementation is outside the OpenSSL FIPS module boundary.2dCVE-2026-171369.8 CRÍ46.3%
——14IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability.6dCVE-2026-685537.1 ALT20.0%
——6Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is_secure_string() validation and is embedded into Redis keys at nine call sites in src/apps/relay/ns_ioalib_engine_impl.c. send_message_to_redis() in src/apps/relay/hiredis_libevent2.c then passes the attacker-controlled key as the format argument to redisAsyncCommand() while supplying only one variadic value, causing hiredis redisvFormatCommand() to read past the va_list. Exploitation can crash the coturn process and terminate active TURN sessions or disclose stack memory into Redis. This issue is fixed in version 4.13.0.10dCVE-2026-159615.2 MED0.9%
——0IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings.5d