PanGPS is responsible for negotiating VPN connections, and it configures network devices, routes, etc.

PanGPS: The PanGPS daemon is started once at boot time.The Linux GlobalProtect client consists of three executable files: Vendor Reference: The CVE-2019-17436 Vulnerability Vulnerability Type: Arbitrary Privileged File WriteĮstimated Risk: High (Local Privilege Escalation to UID 0) GlobalProtect for macOS (verified on Mojave version 10.14.5)Īffected Version: 5.0.4 (and earlier), 4.1.12 (and earlier) Quick FactsĪffected Software: GlobalProtect for Linux (verified on Ubuntu 18.04.2 LTS) We would like to thank Palo Alto Networks for handling and addressing the reported issues in a timely and professional manner. Fixed versions were released on October 15, 2019, by Palo Alto Networks.

The vulnerabilities allowed unprivileged users to reliably escalate to root or SYSTEM on machines where the GlobalProtect software is used.

To recap, the CrowdStrike ® Intelligence Advanced Research Team discovered two distinct vulnerabilities in the Windows, Linux and macOS versions of the Palo Alto Networks GlobalProtect VPN client (CVE-2019-17435, CVE-2019-17436). The first blog covered this exploitation on Windows. This is the second blog in a two-part series covering the exploitation of the Palo Alto Networks GlobalProtect VPN client running on Linux and macOS.

Globalprotect vpn big sur