CVE-2024-9472 - PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic

Back Back to CVE browser

HIGH

PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic

Published Nov 14, 2024

8.7

HIGH

CVSS 4.0

EPSS 0.43%

Description

A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific traffic through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.

Palo Alto Networks VM-Series, Cloud NGFW, and Prisma Access are not affected.

This issue only affects PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series running these specific versions of PAN-OS:

* 10.2.7-h12 * 10.2.8-h10 * 10.2.9-h9 * 10.2.9-h11 * 10.2.10-h2 * 10.2.10-h3 * 10.2.11 * 10.2.11-h1 * 10.2.11-h2 * 10.2.11-h3 * 11.1.2-h9 * 11.1.2-h12 * 11.1.3-h2 * 11.1.3-h4 * 11.1.3-h6 * 11.2.2 * 11.2.2-h1

Affected products

Vendor Palo Alto Networks Product Pan-OS Default
unaffected
- Version
  10.2.7-h12
  Status
  affected
  Constraints
  <10.2.7-h16
- Version
  11.1.2-h9
  Status
  affected
  Constraints
  <11.1.2-h14
- Version
  11.2.2
  Status
  affected
  Constraints
  <11.2.2-h3
- Version
  10.1.0
  Status
  unaffected
  Constraints
  -
- Version
  11.0.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

Pan-OS

unaffected

Version	Status	Constraints
10.2.7-h12	affected	<10.2.7-h16
11.1.2-h9	affected	<11.1.2-h14
11.2.2	affected	<11.2.2-h3
10.1.0	unaffected	-
11.0.0	unaffected	-

Remediation

Vendor solution

This issue is fixed in PAN-OS 10.2.7-h16, PAN-OS 10.2.8-h13, PAN-OS 10.2.9-h14, PAN-OS 10.2.10-h7, PAN-OS 10.2.11-h4, PAN-OS 11.1.2-h14, PAN-OS 11.1.3-h10, PAN-OS 11.2.2-h3, PAN-OS 11.2.3, and all later PAN-OS versions.

Weaknesses (1)

CWE-476

NULL Pointer Dereference