Palo Alto Networks addressed a high-severity PAN-OS flaw that could trigger denial-of-service (DoS) on vulnerable devices.
Palo Alto Networks addressed a high-severity flaw, tracked as CVE-2024-3393 (CVSS score: 8.7), in PAN-OS software that could cause a denial-of-service (DoS) condition.
An unauthenticated attacker can exploit this vulnerability to reboot the firewall by sending a malicious packet through its data plane. Repeated exploitation forces the firewall into maintenance mode.
“A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.” reads the advisory.
The flaw’s severity is reduced to a CVSS score of 7.1 when access is limited to authenticated end users via Prisma Access.
The vulnerability affects PAN-OS versions 10.X and 11.X, including Prisma Access running these versions. It is fixed in PAN-OS 10.1.14-h8, 10.2.10-h12, 11.1.5, 11.2.3, and all later versions.
The vulnerability can be exploited only if DNS Security logging is enabled.
Palo Alto Networks is aware of customers facing denial of service (DoS) conditions when their firewall blocks malicious DNS packets, which trigger this issue.
The cybersecurity vendor addressed the issue with the releases PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions.
The company noted that PAN-OS 11.0 reached the end of life (EOL) on November 17, 2024, for this reason, it will not provide a fix for this release.
To mitigate the issue, customers can set Log Severity to “none” for all DNS Security categories in each Anti-Spyware profile via the DNS Policies settings in Panorama or unmanaged firewalls.
For firewalls managed by Strata Cloud Manager (SCM), users can disable DNS Security logging on each device or across all devices by opening a support case. Prisma Access tenants should also open a support case to disable logging until an upgrade is completed.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, PAN-OS)
