Source: www.securityweek.com – Author: Eduard Kovacs
Palo Alto Networks informed customers late last week that it has patched a zero-day vulnerability that has been exploited to launch denial-of-service (DoS) attacks against its firewalls.
The security hole, tracked as CVE-2024-3393, impacts the DNS Security feature of the PAN-OS software that runs on Palo Alto Networks firewalls. The flaw allows an unauthenticated attacker to cause the firewall to reboot by sending a specially crafted packet through the data plane.
“Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode,” the company warned.
Palo Alto Networks noted that it is “aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue”.
Despite this and CVE-2024-3393’s ‘high severity’ rating, the company has only assigned a ‘moderate urgency’ rating to the vulnerability, noting that PAN-OS software is only affected if it has DNS Security logging enabled and if a DNS Security License or an Advanced DNS Security License is applied — both conditions need to be met for exploitation to be possible.
PAN-OS 10.1.14-h8, 10.2.10-h12, 11.1.5, and 11.2.3 patch the vulnerability. PAN-OS 11.0 reached end of life on November 17 and will not receive a fix. Workarounds and mitigations are also available.
The vendor has credited Estonia’s CERT-EE for providing forensic and analytics assistance. No information is available on how the vulnerability was discovered or about the attacks exploiting it.
It’s not uncommon for threat groups to exploit Palo Alto firewall vulnerabilities in their attacks. In a recent campaign, tracked by the security firm as Operation Lunar Peek, malicious actors exploited two PAN-OS zero-days to hack a significant number of firewalls.
Advertisement. Scroll to continue reading.
Related: New VPN Attack Demonstrated Against Palo Alto Networks, SonicWall Products
Related: Palo Alto Networks Expedition Vulnerability Exploited in Attacks, CISA Warns
Related: Thousands of Palo Alto Firewalls Potentially Impacted by Exploited Vulnerability
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Don’t miss this Live Attack demonstration to learn how hackers operate and gain the knowledge to strengthen your defenses.
Join us as we share best practices for uncovering risks and determining next steps when vetting external resources, implementing solutions, and procuring post-installation support.
Original Post URL: https://www.securityweek.com/palo-alto-networks-patches-firewall-zero-day-exploited-for-dos-attacks/
Category & Tags: Vulnerabilities,exploited,firewall,Palo Alto Networks,Zero-Day – Vulnerabilities,exploited,firewall,Palo Alto Networks,Zero-Day
Views: 6
