Pierluigi Paganini
April 11, 2024
Palo Alto Networks released security updates to address several high-severity vulnerabilities in its PAN-OS operating system.
The company fixed the following DoS vulnerabilities:
CVE-2024-3385 – The company reported that a packet processing mechanism in Palo Alto Networks PAN-OS software allows a remote attacker to reboot hardware-based firewalls. Repeated attacks can eventually trigger a DoS condition by forcing the firewall into maintenance mode, requiring manual intervention to restore online functionality. This issue affects hardware firewall models PA-5400 Series firewalls and PA-7000 Series firewalls when GTP security is disabled.
“Palo Alto Networks is not aware of any malicious exploitation of this issue. This was encountered by two customers in normal production usage.” reads the advisory.
Another DoS vulnerability in PAN-OS addressed by the vendor is tracked as CVE-2024-3384.
A remote attacker can trigger the flaw to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks can eventually trigger a DoS condition by forcing the firewall into maintenance mode, requiring manual intervention to restore online functionality.
The flaw affects only PAN-OS configurations with NTLM authentication enabled.
The third DoS vulnerability addressed by the vendor is tracked as CVE-2024-3382.
“A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This issue applies only to PA-5400 Series devices that are running PAN-OS software with the SSL Forward Proxy feature enabled.” reads the advisory.
Palo Alto Networks also fixed an improper Group Membership Change vulnerability in Cloud Identity Engine (CIE). The PAN-OS issue tracked as CVE-2024-3383 ‘impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules.’
The vendor is not aware of attacks in the wild exploiting any of these vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, DoS)
