Summary: Palo Alto Networks released security updates to address several high-severity vulnerabilities in its PAN-OS operating system, including DoS vulnerabilities and an improper Group Membership Change vulnerability in Cloud Identity Engine (CIE).
Threat Actor: N/A
Victim: Palo Alto Networks
Key Point :
- Palo Alto Networks addressed several high-severity vulnerabilities in its PAN-OS operating system through security updates.
- The vulnerabilities include DoS vulnerabilities that can be exploited by remote attackers to reboot hardware-based firewalls and cause a DoS condition.
- Another vulnerability allows a remote attacker to reboot PAN-OS firewalls by sending Windows NTLM packets from Windows servers.
- A memory leak vulnerability in PAN-OS software can be exploited to send crafted packets that prevent the firewall from processing traffic.
- Palo Alto Networks also fixed an improper Group Membership Change vulnerability in Cloud Identity Engine (CIE) that could impact user access to network resources.
- No known attacks exploiting these vulnerabilities have been reported.
Palo Alto Networks released security updates to address several high-severity vulnerabilities in its PAN-OS operating system.
The company fixed the following DoS vulnerabilities:
CVE-2024-3385 – The company reported that a packet processing mechanism in Palo Alto Networks PAN-OS software allows a remote attacker to reboot hardware-based firewalls. Repeated attacks can eventually trigger a DoS condition by forcing the firewall into maintenance mode, requiring manual intervention to restore online functionality. This issue affects hardware firewall models PA-5400 Series firewalls and PA-7000 Series firewalls when GTP security is disabled.
“Palo Alto Networks is not aware of any malicious exploitation of this issue. This was encountered by two customers in normal production usage.” reads the advisory.
Another DoS vulnerability in PAN-OS addressed by the vendor is tracked as CVE-2024-3384.
A remote attacker can trigger the flaw to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks can eventually trigger a DoS condition by forcing the firewall into maintenance mode, requiring manual intervention to restore online functionality.
The flaw affects only PAN-OS configurations with NTLM authentication enabled.
The third DoS vulnerability addressed by the vendor is tracked as CVE-2024-3382.
“A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This issue applies only to PA-5400 Series devices that are running PAN-OS software with the SSL Forward Proxy feature enabled.” reads the advisory.
Palo Alto Networks also fixed an improper Group Membership Change vulnerability in Cloud Identity Engine (CIE). The PAN-OS issue tracked as CVE-2024-3383 ‘impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules.’
The vendor is not aware of attacks in the wild exploiting any of these vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, DoS)
Source: https://securityaffairs.com/161724/security/palo-alto-networks-pan-os-dos-2.html
“An interesting youtube video that may be related to the article above”