Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
MitM-vulnerability in Palo Alto Networks GlobalProtect

From: Micha Borrmann (Micha.BorrmannSySS.de)
Date: Wed Oct 17 2012 - 13:10:31 CDT

SySS-Advisory: MitM-vulnerability in Palo Alto Networks GlobalProtect

Problem discovered: July 12th 2012
Vendor contacted: July 13th 2012
Advisory published: October 12th 2012

AUTHOR: Micha Borrmann (micha.borrmannsyss.de)
        SySS GmbH
        D-72070 Tuebingen / Germany

APPLICATION: Windows Client
AFFECTED VERSION: 1.1.5-5 (32 Bit Version)
Remotely exploitable: Yes


A User can not recognize an easy to perform man-in-the-middle attack,
because the client is not validate the X.509 certificate from the VPN
gateway. In an untrusted networking environment (like a Wifi hotspot),
the current VPN connection should be classified as not encrypted.

VENDOR STATUS: The vendor published a fixed version (1.1.7) at 10/12/12.

All users should update the clients soon.