Palo Alto Patches Exploited Firewall Denial-of-Service Flaw

Firewall giant Palo Alto Networks is pushing updates to fix a vulnerability that attackers are exploiting to crash customers’ firewalls.

See Also: Cloud Security and the Evolving Role of the Firewall

The flaw exists in the PAN-OS software that runs the company’s appliances. The company said its cloud-native NGFW – it stands for next-generation firewall – isn’t affected.

“A denial-of-service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall,” the company said in a Thursday security advisory. “Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.”

The vulnerability is tracked as CVE-2024-3393.

Firewall administrators have reported active attacks starting Tuesday. “The flaw is exploited when firewall blocks malicious DNS traffic,” one admin posted to a Palo Alto Networks Firewall subreddit. Such functionality is provided by the “Advanced DNS Security” feature in Palo Alto products.

Palo Alto rated the severity of the flaw as being “high,” with a “moderate” urgency for fixing. For firewalls, the vulnerability carries a CVSS value of 8.7. The company said the flaw also exists in its Prisma Access security service edge devices “when only providing access to authenticated end users,” carrying a CVSS rating of 7.1.

British security expert Kevin Beaumont said attackers can exploit the flaw to not just reboot but crash vulnerable devices. “If you run the exploit multiple times against a HA pair of Palo Alto boxes, they both crash and don’t reboot. Doesn’t matter if you don’t present DNSSEC to the internet,” he said in a post to Mastodon. “Repair is physically reboot both boxes. So, patch.”

One Palo Alto firewall administrator said in a Reddit post that immediately before their firewalls started rebooting on Dec. 24 – in hindsight, apparently due to someone exploiting this flaw – they saw an unexpected high-availability failover, but nothing in their logs except for Palo Alto’s WildFire cloud-based malware analysis product updating itself, which turned out to not be the culprit.

“Definitely thought it was weird on Christmas Eve when we had a random HA failover due to ‘low memory condition,'” the admin said. “Our review of the logs didn’t show anything except a Wildfire update that had occurred a minute earlier – which we suspected was the cause. Lesson learned. Palos don’t reboot on their own. Where there is smoke there is a fire.”

Palo Alto said that “DNS Security logging must be enabled for this issue to affect PAN-OS software,” which is part of the products’ “Advanced DNS Security” feature.

The vendor’s website says users must pay for “an active Advanced DNS Security license” to enable this feature, which the company says works using both “machine learning and crowdsourced intelligence” to immediately take action to block potential zero-day attacks and emerging malware.

Whether or not companies have signed up for such a license doesn’t appear to matter, for the purposes of vulnerability exploitation. “Apparently not having the license makes no difference,” one administrator said in the Palo Alto Networks Firewall subreddit Friday, citing information shared by Palo Alto’s Technical Assistance Center. “You are still vulnerable. So the advice is to patch or apply the workaround.”

To fix the flaw, the vendor has deployed a range of PAN-OS updates for versions 11.1.x, 10.2.x and 10.1.x. “This issue is fixed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions,” it said. “Note: PAN-OS 11.0 reached the end of life on Nov. 17, so we do not intend to provide a fix for this release.”

The company also detailed temporary mitigations companies can apply until they’re able to patch.

Palo Alto said Prisma Access customers who use DNS Security with an affected version of PAN-OS versions should apply one of those two workarounds, depending on whether they use the Panorama or Strata Cloud Manager firewall management tools. Those temporary workarounds respectively involve setting DNS Security Log log severity to “none,” or disabling DNS Security logging altogether. Users will need to remember to reenable those features after the vendor issues a fix.

The company promised to publish a Prisma Access within two weeks. “We will perform upgrades in two phases for impacted customers on the weekends of Jan. 3 and Jan. 10,” the company said.

The Palo Alto flaw looks similar to an entirely different zero-day vulnerability that recently came to light in the FortiOS software that runs Fortinet devices, Beaumont said. For the Fortinet products, the vulnerability can be exploited by “a non-management packet which causes FortiOS to run out of memory and enter failopen,” he said. That’s a reference to the out-of-memory mode the devices enter when their intrusion detection system’s raw socket buffer gets full and it can no longer inspect packets. Devices can be set to either “fail open” and let further packets through without inspection, or “fail close” and block all packets until IPS inspection comes back online.

“Just to widen this out – I’m aware of a telco which is experiencing denial of service using both vulns, an e-crime group has basically turned up with firewall non-management zero days which is another escalation,” Beaumont said.

As with the Palo Alto flaw, he said the FortiOS flaw can be remediated by updating still-supported devices to the latest version of the operating system.

Attacking edge devices is a tactic regularly employed by both criminal and nation-state groups (see: Palo Alto Reports Firewalls Exploited Using an Unknown Flaw).