PAN-OS: Threat signatures are evaded by specifically crafted packets
Published Nov 12, 2020
5.3
MEDIUMCVSS 3.1
EPSS 1.34%
Description
A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packets. This technique evades signature-based threat detection. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.17; PAN-OS 9.0 versions earlier than 9.0.11; PAN-OS 9.1 versions earlier than 9.1.5; All versions of PAN-OS 7.1 and PAN-OS 8.0.
Affected products
-
- Version 7.1.*StatusaffectedConstraints-
- Version 8.0.*StatusaffectedConstraints-
- Version 8.1StatusaffectedConstraints<8.1.17
- Version 9.0StatusaffectedConstraints<9.0.11
- Version 9.1StatusaffectedConstraints<9.1.5
- Version 10.0.*StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Palo Alto Networks | Pan-OS | n/a |
|
- ≥ 7.1.0 · ≤ 7.1.26
- ≥ 8.0.0 · ≤ 8.0.20
- ≥ 8.1.0 · < 8.1.17
- ≥ 9.0.0 · < 9.0.11
- ≥ 9.1.0 · < 9.1.5
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
This issue is fixed in PAN-OS 8.1.17, PAN-OS 9.0.11, PAN-OS 9.1.5, and all later PAN-OS versions.
References (1)
- https://security.paloaltonetworks.com/CVE-2020-1999 x_refsource_MISCVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://security.paloaltonetworks.com/CVE-2020-1999 | x_refsource_MISCVendor Advisory |
Change history (0)
No recorded changes yet.