PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing

Overview

A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption.

Panorama and Prisma® Access are not affected by this vulnerability.

Affected

• cloud_ngfw All
• PAN-OS >= 12.2.0 < 12.2.4-h2
• PAN-OS >= 12.1.0 < 12.1.10-h4
• PAN-OS >= 11.2.0 < 11.2.16-h2
• PAN-OS >= 11.1.0 < 11.1.16-h5
• prisma_access

Remediation

VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. PAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h2 or later. PAN-OS 12.1 12.1.0 through 12.1.10-h* Upgrade to 12.1.10-h4 or later. PAN-OS 11.2 11.2.0 through 11.2.16-h* Upgrade to 11.2.16-h2 or later. PAN-OS 11.1 11.1.0 through 11.1.16-h* Upgrade to 11.1.16-h5 or later. All older Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access No action needed.

Workarounds

Customers can mitigate the risk of this issue by taking the following actions.

Detach the SCTP Protection profile from active Security Policy rules allowing SCTP traffic.

Disable configured DNS proxy objects:

• Navigate to Network > DNS Proxy (https://docs.paloaltonetworks.com/ngfw/help/10-1/network/network-dns-proxy).

• Click on each configured DNS Proxy object.

• Uncheck the Enable checkbox.

• Click OK and Commit the changes.

Update any active OSPFv3 Auth Profiles under Network > Network Profiles > OSPFv3 Auth (https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing/create-ospfv3-routing-profiles) to use standard cryptographic authentication other than ESP-NULL.