CVE-2024-3393
Vulnerability from cvelistv5
Published
2024-12-27 09:44
Modified
2024-12-30 17:20
Severity ?
EPSS score ?
Summary
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
References
Impacted products
Vendor | Product | Version | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Palo Alto Networks | Cloud NGFW | |||||||||
|
CISA Known exploited vulnerability
Data from the Known Exploited Vulnerabilities Catalog
Date added: 2024-12-30
Due date: 2025-01-20
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Used in ransomware: Unknown
Notes: https://security.paloaltonetworks.com/CVE-2024-3393 ; https://nvd.nist.gov/vuln/detail/CVE-2024-3393
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-3393", "options": [ { "Exploitation": "active" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-12-27T00:00:00+00:00", "version": "2.0.3" }, "type": "ssvc" } }, { "other": { "content": { "dateAdded": "2024-12-30", "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, "type": "kev" } } ], "providerMetadata": { "dateUpdated": "2024-12-30T17:20:22.893Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "timeline": [ { "lang": "en", "time": "2024-12-30T00:00:00+00:00", "value": "CVE-2024-3393 added to CISA KEV" } ], "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Cloud NGFW", "vendor": "Palo Alto Networks", "versions": [ { "status": "unaffected", "version": "All" } ] }, { "cpes": [ "cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.2.1:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.2.1:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.2:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h8:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h6:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h5:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h11:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h10:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h9:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h8:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h7:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h6:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h5:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h15:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h14:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h13:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h12:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h11:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h10:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h9:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h8:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h7:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h6:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h5:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h8:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h18:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h17:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h16:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h15:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h13:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h12:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h10:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h8:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h7:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h6:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h5:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h18:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h17:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h16:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h15:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h14:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h12:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h11:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h9:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h8:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h7:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h6:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h5:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h5:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1:-:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "PAN-OS", "vendor": "Palo Alto Networks", "versions": [ { "changes": [ { "at": "11.2.3", "status": "unaffected" } ], "lessThan": "11.2.3", "status": "affected", "version": "11.2.0", "versionType": "custom" }, { "changes": [ { "at": "11.1.2-h16", "status": "unaffected" }, { "at": "11.1.3-h13", "status": "unaffected" }, { "at": "11.1.4-h7", "status": "unaffected" }, { "at": "11.1.5", "status": "unaffected" } ], "lessThan": "11.1.2-h16", "status": "affected", "version": "11.1.0", "versionType": "custom" }, { "changes": [ { "at": "10.2.8-h19", "status": "unaffected" }, { "at": "10.2.9-h19", "status": "unaffected" }, { "at": "10.2.10-h12", "status": "unaffected" }, { "at": "10.2.11-h10", "status": "unaffected" }, { "at": "10.2.12-h4", "status": "unaffected" }, { "at": "10.2.13-h2", "status": "unaffected" }, { "at": "10.2.14", "status": "unaffected" } ], "lessThan": "10.2.8-h19", "status": "affected", "version": "10.2.8", "versionType": "custom" }, { "changes": [ { "at": "10.1.14-h8", "status": "unaffected" }, { "at": "10.1.15", "status": "unaffected" } ], "lessThan": "10.1.14-h8", "status": "affected", "version": "10.1.14", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Prisma Access" ], "product": "PAN-OS", "vendor": "Palo Alto Networks", "versions": [ { "changes": [ { "at": "10.2.8", "status": "affected" }, { "at": "10.2.9-h19", "status": "unaffected" }, { "at": "10.2.10-h12", "status": "unaffected" } ], "lessThan": "10.2.8", "status": "unaffected", "version": "10.2.0", "versionType": "custom" }, { "changes": [ { "at": "11.2.3", "status": "unaffected" } ], "lessThan": "11.2.3", "status": "affected", "version": "11.2.0", "versionType": "custom" } ] } ], "configurations": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eBoth of the following must be true for PAN-OS software to be affected:\u003cbr\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003eEither a DNS Security License or an Advanced DNS Security License must be applied, AND\u003cbr\u003e\u003c/li\u003e\u003cli\u003eDNS Security logging must be enabled.\u003c/li\u003e\u003c/ol\u003e" } ], "value": "Both of the following must be true for PAN-OS software to be affected:\n\n\n * Either a DNS Security License or an Advanced DNS Security License must be applied, AND\n\n * DNS Security logging must be enabled." } ], "credits": [ { "lang": "en", "type": "reporter", "value": "Palo Alto Networks thanks the CERT-EE team for their extra effort in providing invaluable forensic and analytic assistance." } ], "datePublic": "2024-12-27T02:30:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode." } ], "value": "A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode." } ], "exploits": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Palo Alto Networks is aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue." } ], "value": "Palo Alto Networks is aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue." } ], "impacts": [ { "capecId": "CAPEC-540", "descriptions": [ { "lang": "en", "value": "CAPEC-540 Overread Buffers" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "An attacker sends a malicious packet through the firewall, which processes a malicious packet that triggers this issue." } ] }, { "cvssV4_0": { "Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "Prisma Access, when only providing access to authenticated end users, processes a malicious packet that triggers this issue." } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-12-28T01:51:29.594Z", "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://security.paloaltonetworks.com/CVE-2024-3393" } ], "solutions": [ { "lang": "eng", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003e\u003cspan\u003eThis issue is fixed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eNote: PAN-OS 11.0 reached the end of life (EOL) on November 17, 2024, so we do not intend to provide a fix for this release.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003ePrisma Access customers using DNS Security with affected PAN-OS versions should apply one of the workarounds provided below. We will perform upgrades in two phases for impacted customers on the weekends of January 3rd and January 10th. You can request an expedited Prisma Access upgrade to the latest PAN-OS version by opening a \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.paloaltonetworks.com/Support/Index\"\u003e\u003cspan\u003esupport case\u003c/span\u003e\u003c/a\u003e\u003cspan\u003e.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eIn addition, to provide the most seamless upgrade path for our customers, we are making fixes available for other TAC-preferred and commonly deployed maintenance releases.\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u200b\u200bAdditional PAN-OS 11.1 fixes:\u003c/p\u003e\u003cdiv\u003e\u003cul\u003e\u003cli\u003e11.1.2-h16\u003c/li\u003e\u003cli\u003e11.1.3-h13\u003c/li\u003e\u003cli\u003e11.1.4-h7\u003c/li\u003e\u003cli\u003e11.1.5\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e\u003cdiv\u003eAdditional PAN-OS 10.2 fixes:\u003c/div\u003e\u003cdiv\u003e\u003cul\u003e\u003cli\u003e10.2.8-h19\u003c/li\u003e\u003cli\u003e10.2.9-h19\u003c/li\u003e\u003cli\u003e10.2.10-h12\u003c/li\u003e\u003cli\u003e10.2.11-h10\u003c/li\u003e\u003cli\u003e10.2.12-h4\u003c/li\u003e\u003cli\u003e10.2.13-h2\u003c/li\u003e\u003cli\u003e10.2.14\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e\u003cdiv\u003eAdditional PAN-OS 10.1 fixes:\u003c/div\u003e\u003cdiv\u003e\u003cul\u003e\u003cli\u003e10.1.14-h8\u003c/li\u003e\u003cli\u003e10.1.15\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e\u003cdiv\u003eAdditional PAN-OS fixes only applicable to Prisma Access:\u003c/div\u003e\u003cdiv\u003e\u003cul\u003e\u003cli\u003e10.2.9-h19\u003c/li\u003e\u003cli\u003e10.2.10-h12\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e" } ], "value": "This issue is fixed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions.\n\nNote: PAN-OS 11.0 reached the end of life (EOL) on November 17, 2024, so we do not intend to provide a fix for this release.\n\nPrisma Access customers using DNS Security with affected PAN-OS versions should apply one of the workarounds provided below. We will perform upgrades in two phases for impacted customers on the weekends of January 3rd and January 10th. You can request an expedited Prisma Access upgrade to the latest PAN-OS version by opening a support case https://support.paloaltonetworks.com/Support/Index .\n\nIn addition, to provide the most seamless upgrade path for our customers, we are making fixes available for other TAC-preferred and commonly deployed maintenance releases.\n\n\u200b\u200bAdditional PAN-OS 11.1 fixes:\n\n * 11.1.2-h16\n * 11.1.3-h13\n * 11.1.4-h7\n * 11.1.5\n\n\n\n\nAdditional PAN-OS 10.2 fixes:\n\n * 10.2.8-h19\n * 10.2.9-h19\n * 10.2.10-h12\n * 10.2.11-h10\n * 10.2.12-h4\n * 10.2.13-h2\n * 10.2.14\n\n\n\n\nAdditional PAN-OS 10.1 fixes:\n\n * 10.1.14-h8\n * 10.1.15\n\n\n\n\nAdditional PAN-OS fixes only applicable to Prisma Access:\n\n * 10.2.9-h19\n * 10.2.10-h12" } ], "source": { "defect": [ "PAN-259351", "PAN-219034" ], "discovery": "USER" }, "timeline": [ { "lang": "en", "time": "2024-12-27T02:30:00.000Z", "value": "Initial publication" } ], "title": "PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "If your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eUnmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama\u003c/b\u003e\u003cb\u003e\u003cbr\u003e\u003c/b\u003e\u003col\u003e\u003cli\u003eFor each Anti-spyware profile, navigate to Objects \u2192 Security Profiles \u2192 Anti-spyware \u2192 (select a profile) \u2192 DNS Policies \u2192 DNS Security.\u003c/li\u003e\u003cli\u003eChange the Log Severity to \"none\" for all configured DNS Security categories.\u003cbr\u003e\u003c/li\u003e\u003cli\u003eCommit the changes.\u003cbr\u003e\u003c/li\u003e\u003c/ol\u003eRemember to revert the Log Severity settings once the fixes are applied.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eNGFW managed by Strata Cloud Manager (SCM)\u003c/b\u003e\u003cbr\u003e\u003cbr\u003e\u003cdiv\u003e\u003cdiv\u003eYou can choose one of the following mitigation options:\u003c/div\u003e\u003cdiv\u003e\u003col\u003e\u003cli\u003eOption 1: Disable DNS Security logging directly on each NGFW by following the PAN-OS steps above.\u003c/li\u003e\u003cli\u003eOption 2: Disable DNS Security logging across all NGFWs in your tenant by opening a \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.paloaltonetworks.com/Support/Index\"\u003esupport case\u003c/a\u003e.\u003c/li\u003e\u003c/ol\u003e\u003c/div\u003e\u003cb\u003e\u003cp\u003ePrisma Access managed by Strata Cloud Manager (SCM)\u003c/p\u003e\u003c/b\u003e\u003c/div\u003e\u003cp\u003eUntil we perform an upgrade of your Prisma Access tenant, you can disable DNS Security logging across all NGFWs in your tenant by opening a \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.paloaltonetworks.com/Support/Index\"\u003esupport case\u003c/a\u003e. If you would like to expedite the upgrade, please make a note of that in the support case.\u003c/p\u003e\u003cb\u003e\u003c/b\u003e" } ], "value": "If your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment.\n\nUnmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama\n * For each Anti-spyware profile, navigate to Objects \u2192 Security Profiles \u2192 Anti-spyware \u2192 (select a profile) \u2192 DNS Policies \u2192 DNS Security.\n * Change the Log Severity to \"none\" for all configured DNS Security categories.\n\n * Commit the changes.\n\nRemember to revert the Log Severity settings once the fixes are applied.\n\nNGFW managed by Strata Cloud Manager (SCM)\n\nYou can choose one of the following mitigation options:\n\n * Option 1: Disable DNS Security logging directly on each NGFW by following the PAN-OS steps above.\n * Option 2: Disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.paloaltonetworks.com/Support/Index .\n\n\nPrisma Access managed by Strata Cloud Manager (SCM)\n\n\n\nUntil we perform an upgrade of your Prisma Access tenant, you can disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.paloaltonetworks.com/Support/Index . If you would like to expedite the upgrade, please make a note of that in the support case." } ], "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "assignerShortName": "palo_alto", "cveId": "CVE-2024-3393", "datePublished": "2024-12-27T09:44:24.538Z", "dateReserved": "2024-04-05T17:40:24.596Z", "dateUpdated": "2024-12-30T17:20:22.893Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "cisa_known_exploited": { "cveID": "CVE-2024-3393", "cwes": "[\"CWE-754\"]", "dateAdded": "2024-12-30", "dueDate": "2025-01-20", "knownRansomwareCampaignUse": "Unknown", "notes": "https://security.paloaltonetworks.com/CVE-2024-3393 ; https://nvd.nist.gov/vuln/detail/CVE-2024-3393", "product": "PAN-OS", "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "shortDescription": "Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.", "vendorProject": "Palo Alto Networks", "vulnerabilityName": "Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability" }, "nvd": "{\"cve\":{\"id\":\"CVE-2024-3393\",\"sourceIdentifier\":\"psirt@paloaltonetworks.com\",\"published\":\"2024-12-27T10:15:17.270\",\"lastModified\":\"2025-01-04T02:00:01.597\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de DNS Security feature de Palo Alto Networks PAN-OS software permite que un atacante no autenticado env\u00ede un paquete malicioso a trav\u00e9s del plano de datos del firewall que reinicia el firewall. Los intentos repetidos de activar esta condici\u00f3n har\u00e1n que el firewall entre en modo de mantenimiento.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@paloaltonetworks.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnerableSystemConfidentiality\":\"NONE\",\"vulnerableSystemIntegrity\":\"NONE\",\"vulnerableSystemAvailability\":\"HIGH\",\"subsequentSystemConfidentiality\":\"NONE\",\"subsequentSystemIntegrity\":\"NONE\",\"subsequentSystemAvailability\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirements\":\"NOT_DEFINED\",\"integrityRequirements\":\"NOT_DEFINED\",\"availabilityRequirements\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnerableSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedVulnerableSystemIntegrity\":\"NOT_DEFINED\",\"modifiedVulnerableSystemAvailability\":\"NOT_DEFINED\",\"modifiedSubsequentSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedSubsequentSystemIntegrity\":\"NOT_DEFINED\",\"modifiedSubsequentSystemAvailability\":\"NOT_DEFINED\",\"safety\":\"NOT_DEFINED\",\"automatable\":\"NO\",\"recovery\":\"USER\",\"valueDensity\":\"CONCENTRATED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"AMBER\"}}]},\"cisaExploitAdd\":\"2024-12-30\",\"cisaActionDue\":\"2025-01-20\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability\",\"weaknesses\":[{\"source\":\"psirt@paloaltonetworks.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-754\"}]}],\"references\":[{\"url\":\"https://security.paloaltonetworks.com/CVE-2024-3393\",\"source\":\"psirt@paloaltonetworks.com\"}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.