CVE-2021-3057: GlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or Gateway

Q: What is CVE-2021-3057?

CVE-2021-3057 is a stack-based buffer overflow vulnerability in the Palo Alto Networks GlobalProtect app that allows a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges.

Q: Which versions of the GlobalProtect app are affected by CVE-2021-3057?

GlobalProtect app versions earlier than 5.1 are affected by CVE-2021-3057.

Q: What is the severity of CVE-2021-3057?

The severity of CVE-2021-3057 is critical, with a severity score of 8.1.

Q: How can a man-in-the-middle attacker exploit CVE-2021-3057?

A man-in-the-middle attacker can exploit CVE-2021-3057 by intercepting and modifying network traffic between the GlobalProtect app and the server it communicates with.

Q: Is there a fix available for CVE-2021-3057?

Yes, Palo Alto Networks has released a patch to address the vulnerability. Affected users should update to the latest version of the GlobalProtect app.

Published Oct 13, 2021

Updated

A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.9 on Windows; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.8 on Windows; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.8 on the Universal Windows Platform; GlobalProtect app 5.3 versions earlier than GlobalProtect app 5.3.1 on Linux.

Affected Software

13 affected components

Palo Alto Networks Globalprotect Linux>=5.0<=5.0.8

Palo Alto Networks Globalprotect Macos>=5.0<=5.0.9

Palo Alto Networks Globalprotect Windows>=5.0<=5.0.10

Palo Alto Networks Globalprotect Linux>=5.1<=5.1.1

Palo Alto Networks Globalprotect Universal Windows Platform>=5.1<=5.1.1

Palo Alto Networks Globalprotect Windows>=5.1<5.1.9

Palo Alto Networks Globalprotect Macos>=5.1.0<=5.1.4

Palo Alto Networks Globalprotect Linux>=5.2<5.2.8

Palo Alto Networks Globalprotect Macos>=5.2<5.2.8

Palo Alto Networks Globalprotect Universal Windows Platform>=5.2<5.2.8

Palo Alto Networks Globalprotect Windows>=5.2<5.2.8

Palo Alto Networks Globalprotect Linux>=5.3<5.3.1

Palo Alto Networks Globalprotect Universal Windows Platform=5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Palo Alto Networks GlobalProtect app to a version that resolves this vulnerability.
Fixed in 5.1.9
Upgrade
Upgrade Palo Alto Networks GlobalProtect app to a version that resolves this vulnerability.
Fixed in 5.2.8
Upgrade
Upgrade Palo Alto Networks GlobalProtect app to a version that resolves this vulnerability.
Fixed in 5.3.1

Event History

Oct 13, 2021

CVE Published

via MITRE·04:10 PM

Data Sourced

via MITRE·04:10 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-3057?

CVE-2021-3057 is a stack-based buffer overflow vulnerability in the Palo Alto Networks GlobalProtect app that allows a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges.

Which versions of the GlobalProtect app are affected by CVE-2021-3057?

GlobalProtect app versions earlier than 5.1 are affected by CVE-2021-3057.

What is the severity of CVE-2021-3057?

The severity of CVE-2021-3057 is critical, with a severity score of 8.1.

How can a man-in-the-middle attacker exploit CVE-2021-3057?