Palo Alto Networks PAN-OS DNS Security Denial of Service Vulnerability
CVE-2024-3393 Published on December 27, 2024

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Vendor Advisory NVD

Known Exploited Vulnerability

This Palo Alto Networks PAN-OS Malformed DNS Packet Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malformed DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

The following remediation steps are recommended / required by January 20, 2025: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability Analysis

CVE-2024-3393 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Improper Check for Unusual or Exceptional Conditions

The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.


Products Associated with CVE-2024-3393

You can be notified by stack.watch whenever vulnerabilities like CVE-2024-3393 are published in these products:

Palo Alto Networks PAN-OS
 

What versions of PAN-OS are vulnerable to CVE-2024-3393?

Each of the following must match for the vulnerability to exist.