7.5

CVE-2024-3393

Warnung

PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Paloaltonetworks ≫ Pan-os Version >= 11.1.0 <= 11.1.1
Paloaltonetworks ≫ Pan-os Version >= 11.2.0 < 11.2.3
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update -
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h2
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h4
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h6
Paloaltonetworks ≫ Pan-os Version 10.2.8 Update -
Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h10
Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h13
Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h15
Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h18
Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h3
Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h4
Paloaltonetworks ≫ Pan-os Version 10.2.9 Update -
Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h1
Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h11
Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h14
Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h16
Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h18
Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h9
Paloaltonetworks ≫ Pan-os Version 10.2.10 Update -
Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h10
Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h2
Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h3
Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h4
Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h5
Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h7
Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h9
Paloaltonetworks ≫ Pan-os Version 10.2.11 Update -
Paloaltonetworks ≫ Pan-os Version 10.2.11 Update h1
Paloaltonetworks ≫ Pan-os Version 10.2.11 Update h2
Paloaltonetworks ≫ Pan-os Version 10.2.11 Update h3
Paloaltonetworks ≫ Pan-os Version 10.2.11 Update h4
Paloaltonetworks ≫ Pan-os Version 10.2.11 Update h6
Paloaltonetworks ≫ Pan-os Version 10.2.11 Update h9
Paloaltonetworks ≫ Pan-os Version 10.2.12 Update -
Paloaltonetworks ≫ Pan-os Version 10.2.12 Update h1
Paloaltonetworks ≫ Pan-os Version 10.2.12 Update h2
Paloaltonetworks ≫ Pan-os Version 10.2.12 Update h3
Paloaltonetworks ≫ Pan-os Version 10.2.13 Update -
Paloaltonetworks ≫ Pan-os Version 10.2.13 Update h1
Paloaltonetworks ≫ Pan-os Version 11.1.2 Update -
Paloaltonetworks ≫ Pan-os Version 11.1.2 Update h1
Paloaltonetworks ≫ Pan-os Version 11.1.2 Update h12
Paloaltonetworks ≫ Pan-os Version 11.1.2 Update h14
Paloaltonetworks ≫ Pan-os Version 11.1.2 Update h15
Paloaltonetworks ≫ Pan-os Version 11.1.2 Update h3
Paloaltonetworks ≫ Pan-os Version 11.1.2 Update h4
Paloaltonetworks ≫ Pan-os Version 11.1.2 Update h9
Paloaltonetworks ≫ Pan-os Version 11.1.3 Update -
Paloaltonetworks ≫ Pan-os Version 11.1.3 Update h1
Paloaltonetworks ≫ Pan-os Version 11.1.3 Update h10
Paloaltonetworks ≫ Pan-os Version 11.1.3 Update h11
Paloaltonetworks ≫ Pan-os Version 11.1.3 Update h2
Paloaltonetworks ≫ Pan-os Version 11.1.3 Update h4
Paloaltonetworks ≫ Pan-os Version 11.1.3 Update h6
Paloaltonetworks ≫ Pan-os Version 11.1.4 Update -
Paloaltonetworks ≫ Pan-os Version 11.1.4 Update h1
Paloaltonetworks ≫ Pan-os Version 11.1.4 Update h4
Paloaltonetworks ≫ Prisma Access Version -
   Paloaltonetworks ≫ Pan-os Version >= 10.2.11 < 11.2.3
   Paloaltonetworks ≫ Pan-os Version 10.2.8 Update -
   Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h10
   Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h13
   Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h15
   Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h18
   Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h19
   Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h3
   Paloaltonetworks ≫ Pan-os Version 10.2.8 Update h4
   Paloaltonetworks ≫ Pan-os Version 10.2.9 Update -
   Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h1
   Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h11
   Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h14
   Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h16
   Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h18
   Paloaltonetworks ≫ Pan-os Version 10.2.9 Update h9
   Paloaltonetworks ≫ Pan-os Version 10.2.10 Update -
   Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h10
   Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h2
   Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h3
   Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h4
   Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h5
   Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h7
   Paloaltonetworks ≫ Pan-os Version 10.2.10 Update h9

30.12.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

Schwachstelle

Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 28.62% 0.979
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
psirt@paloaltonetworks.com 8.7 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber
CWE-754 Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

https://security.paloaltonetworks.com/CVE-2024-3393
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3393
US Government Resource