Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.0768
CVE-2023-0002 Cortex XDR Agent: Product Disruption by Local Windows User
9 February 2023
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cortex XDR Agent
Publisher: Palo Alto Networks
Operating System: Windows
Resolution: Patch/Upgrade
CVE Names: CVE-2023-0002
Original Bulletin:
https://securityadvisories.paloaltonetworks.com/CVE-2023-0002
Comment: CVSS (Max): 5.5 CVE-2023-0002 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
Palo Alto Networks Security Advisories / CVE-2023-0002
CVE-2023-0002 Cortex XDR Agent: Product Disruption by Local Windows User
047910
Severity 5.5 . MEDIUM
Attack Vector LOCAL
Scope UNCHANGED
Attack Complexity LOW
Confidentiality Impact NONE
Privileges Required LOW
Integrity Impact NONE
User Interaction NONE
Availability Impact HIGH
NVD JSON
Published 2023-02-08
Updated 2023-02-08
Reference CPATR-13215 and CPATR-13184
Discovered externally
Description
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR
agent on Windows devices allows a local user to execute privileged cytool
commands that disable or uninstall the agent.
Product Status
Versions Affected Unaffected
Cortex XDR Agent 7.9 None all
Cortex XDR Agent 7.8 None all
Cortex XDR Agent 7.5 < 7.5.101-CE on Windows >= 7.5.101-CE on Windows
Cortex XDR Agent 5.0 < 5.0.12.22203 on Windows >= 5.0.12.22203 on Windows
Severity:MEDIUM
CVSSv3.1 Base Score:5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness Type
CWE-693 Protection Mechanism Failure
Solution
This issue is fixed in Cortex XDR agent 5.0.12.22203, Cortex XDR agent
7.5.101-CE, and all later supported Cortex XDR agent versions.
Workarounds and Mitigations
There are no known workarounds for this issue.
Acknowledgments
Palo Alto Networks thanks Fernando Romero de la Morena and Robert McCallum
(M42D) for discovering and reporting this issue.
Timeline
2023-02-08 Initial publication
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBY+R2fskNZI30y1K9AQiSARAAqsJCfv6Gqr9nDObUuck3pQSMvOL1TQHt
CKUeavkYxFIzhNBJmdaB9Wzi2NaloJH3/oPdxns+wkxaUZHoO6RwA4dwLTXUm9dM
6jLX8QeeU9aYymCdC0TWpOcmsXAsBe28fufopK9uNiLrUyCB71kYH88YVircVcbP
X8WE1pGHmdrdVF+xwb5AxoF9U5j2xlWJ2ee9zAwVfIPUEKU+2iUJ8mtCJOYd9EVC
qutIZ5Kh+jA8Y2i5U7or6W0aGRO1bP6jibQus4BXt9jj75d1u6mr3C0khoMqEjMW
fU1Swqi2I/wmxoixnoU/uxKFU1pn29aAMRpbZ0y9lKMjL/9dSSWOM5zFbujIWkiP
YUm6NZ5/YxgPLORZDFqU1UYKlSdnt8/0qLb8/f+UOpXPxq5lQBs6qUS5LUCLrPrE
VdJ5vWuxyfkuSb36LMz9M7aAHPEDlTGNdNzB5XsS2NIqDrLitRa0N3Wefj3F/RI+
NyLKENCPtM5Xvjk4zyWITn1+p+yWoLeSn2ZvmX/VyFo0Faknh3EGpBlTcRfTsvR4
nrOXljKMDVGKZIAZSxbnMWtxoWcA0HKMJXT41likQkdQUN/LTO5nj6OVp+YiDup5
lAFipUVVXmjBRIaXbpF/o/hN57uKc0kX4847Iabwbyxmt3UFSf5mQu2u04Mp41ml
QJjpcvKlXu4=
=jRGT
-----END PGP SIGNATURE-----