What is PAN-SA-2016-0007?

PAN-SA-2016-0007 is a security advisory published by Palo Alto Networks Security Advisories with Medium severity. PAN-SA-2016-0007 User-ID Agent API Access

Why does PAN-SA-2016-0007 have no CVE ID yet?

Palo Alto Networks Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by PAN-SA-2016-0007?

PAN-SA-2016-0007 affects 1 product, including: User-ID Agent.

PAN-SA-2016-0007MediumDisclosed before NVD

PAN-SA-2016-0007 User-ID Agent API Access

Vendor

Palo Alto Networks Security Advisories

Published

May 23, 2016

Last Modified

May 23, 2016

📋 Description

The Palo Alto Networks User-ID agent for Windows implements an API to retrieve the agent’s configuration. This TLS-secured API call returns encrypted credentials to the domain account configured on the User-ID agent, which has read-only rights for Security Event Logs on Domain Controllers. Anyone with access to the User-ID agent Service TCP port can retrieve this encrypted password by invoking this API. (Ref #93349) Only users who possess network level access to the User-ID agent Service TCP port can invoke this API. This issue affects Windows devices running all versions of User-ID agent up to 7.0.3

🎯 Affected products1

User-ID Agent

✅ Remediation

User-ID agent 7.0.4 and later releases Workarounds and mitigations: Only users on the network can access the User-ID agent Service TCP port and make this API call. Palo Alto Networks recommends that the host running the User-ID agent and the Domain Controllers share the same network-level access restrictions. The User-ID agent should be able to reach only the Domain Controllers and only accessible by Palo Alto Networks firewalls to prevent direct access by malevolent entities.

🔗 References (1)

advisoryhttps://security.paloaltonetworks.com/PAN-SA-2016-0007