Palo Alto Networks informed customers late last week that it has patched a zero-day vulnerability that has been exploited to launch denial-of-service (DoS) attacks against its firewalls.
The security hole, tracked as CVE-2024-3393, impacts the DNS Security feature of the PAN-OS software that runs on Palo Alto Networks firewalls. The flaw allows an unauthenticated attacker to cause the firewall to reboot by sending a specially crafted packet through the data plane.
“Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode,” the company warned.
Palo Alto Networks noted that it is “aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue”.
Despite this and CVE-2024-3393’s ‘high severity’ rating, the company has only assigned a ‘moderate urgency’ rating to the vulnerability, noting that PAN-OS software is only affected if it has DNS Security logging enabled and if a DNS Security License or an Advanced DNS Security License is applied — both conditions need to be met for exploitation to be possible.
PAN-OS 10.1.14-h8, 10.2.10-h12, 11.1.5, and 11.2.3 patch the vulnerability. PAN-OS 11.0 reached end of life on November 17 and will not receive a fix. Workarounds and mitigations are also available.
The vendor has credited Estonia’s CERT-EE for providing forensic and analytics assistance. No information is available on how the vulnerability was discovered or about the attacks exploiting it.
It’s not uncommon for threat groups to exploit Palo Alto firewall vulnerabilities in their attacks. In a recent campaign, tracked by the security firm as Operation Lunar Peek, malicious actors exploited two PAN-OS zero-days to hack a significant number of firewalls.
Related: New VPN Attack Demonstrated Against Palo Alto Networks, SonicWall Products
Related: Palo Alto Networks Expedition Vulnerability Exploited in Attacks, CISA Warns
Related: Thousands of Palo Alto Firewalls Potentially Impacted by Exploited Vulnerability
