Lucene search

Palo_altoCVELIST:CVE-2024-3384

HistoryApr 10, 2024 - 5:06 p.m.

CVE-2024-3384 PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets

2024-04-1017:06:21

CWE-1286

palo_alto

www.cve.org

cve-2024-3384

vulnerability

palo alto networks

remote attacker

reboot

firewalls

ntlm packets

windows servers

denial of service

maintenance mode

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

9.1%

JSON

A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PAN-OS",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "changes": [
          {
            "at": "8.1.24",
            "status": "unaffected"
          }
        ],
        "lessThan": "8.1.24",
        "status": "affected",
        "version": "8.1.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.0.17",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.0.17",
        "status": "affected",
        "version": "9.0.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.1.15-h1",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.1.15-h1",
        "status": "affected",
        "version": "9.1.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.0.12",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.0.12",
        "status": "affected",
        "version": "10.0.0",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "10.1.0"
      },
      {
        "status": "unaffected",
        "version": "10.2.0"
      },
      {
        "status": "unaffected",
        "version": "11.0.0"
      },
      {
        "status": "unaffected",
        "version": "11.1.0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Cloud NGFW",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "All"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Prisma Access",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "All"
      }
    ]
  }
]

References

security.paloaltonetworks.com/CVE-2024-3384

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVELIST:CVE-2024-3384