CVE-2020-2039: 
PAN-OS vulnerability analysis and mitigation

CVE-2020-2039 is an uncontrolled resource consumption vulnerability discovered in Palo Alto Networks PAN-OS that was disclosed on September 9, 2020. The vulnerability affects the management web interface of PAN-OS versions 8.1 (earlier than 8.1.16), 9.0 (earlier than 9.0.10), 9.1 (earlier than 9.1.4), and 10.0 (earlier than 10.0.1). This vulnerability allows a remote unauthenticated user to upload temporary files that are not properly deleted after the request is finished (Palo Alto Networks).

The vulnerability is classified as an Uncontrolled Resource Consumption (CWE-400) issue with a CVSS v3.1 Base Score of 5.3 (Medium severity). The attack vector is network-based, with low attack complexity and requires no privileges or user interaction. While the vulnerability has no impact on confidentiality or integrity, it does have a low impact on availability. The technical scope is unchanged, meaning the impact is limited to the vulnerable component (Palo Alto Networks).

An attacker can exploit this vulnerability to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted. This can lead to a denial-of-service condition specifically affecting the management interface of the PAN-OS system (Palo Alto Networks).

Palo Alto Networks has acknowledged that while they are not aware of any malicious attempts to exploit this vulnerability in the wild, they are aware of publicly available information that may help construct proof of concept exploits (Palo Alto Networks).

The vulnerability has been fixed in PAN-OS versions 8.1.16, 9.0.10, 9.1.4, 10.0.1, and all later versions. As a temporary workaround until the PAN-OS software can be upgraded, administrators can enable signatures for Unique Threat ID 59957 on traffic destined for the GlobalProtect portal, gateway, or VPN to block attacks. Additionally, following best practices for securing the PAN-OS management web interface is recommended (Palo Alto Networks).