CVE-2020-1989: Global Protect Agent: Incorrect privilege assignment allows local privilege escalation
An incorrect privilege assignment vulnerability when writing application-specific files in the Palo Alto Networks Global Protect Agent for Linux on ARM platform allows a local authenticated user to gain root privileges on the system. This issue affects Palo Alto Networks Global Protect Agent for Linux 5.0 versions before 5.0.8; 5.1 versions before 5.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks Global Protect Agent for Linux (ARM)to a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
Palo Alto Networks Global Protect Agent for Linux (ARM)to a version that resolves this vulnerability.Fixed in 5.1.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-1989.
What software is affected by this vulnerability?
Palo Alto Networks Global Protect Agent for Linux on ARM platform versions 5.0 to 5.1.1 are affected.
What is the severity level of CVE-2020-1989?
The severity level of CVE-2020-1989 is high with a CVSS score of 7.8.
How does this vulnerability occur?
This vulnerability occurs due to an incorrect privilege assignment when writing application-specific files.
How can a local authenticated user exploit this vulnerability?
A local authenticated user can exploit this vulnerability to gain root privileges on the system.