{"uuid": "6608623d-c8c2-494f-a4a8-41a12a6a7cc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "title": "PaloAlto - CVE-2024-3393 PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet", "description": "# CVE-2024-3393 PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet\nRef: [https://security.paloaltonetworks.com/CVE-2024-3393](https://security.paloaltonetworks.com/CVE-2024-3393)\n\nA Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.\n\nSee the Solution section for additional fixes to commonly deployed maintenance releases.\n\nDNS Security logging must be enabled for this issue to affect PAN-OS software.\n\nPalo Alto Networks is aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue.\n\nThis issue is fixed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions.\n\nNote: PAN-OS 11.0 reached the end of life (EOL) on November 17, 2024, so we do not intend to provide a fix for this release.\n\nPrisma Access customers using DNS Security with affected PAN-OS versions should apply one of the workarounds provided below. We will perform upgrades in two phases for impacted customers on the weekends of January 3rd and January 10th. You can request an expedited Prisma Access upgrade to the latest PAN-OS version by opening a [support case](https://support.paloaltonetworks.com/Support/Index).\n\nIn addition, to provide the most seamless upgrade path for our customers, we are making fixes available for other TAC-preferred and commonly deployed maintenance releases.\n\nRemember to revert the Log Severity settings once the fixes are applied.\n\nUntil we perform an upgrade of your Prisma Access tenant, you can disable DNS Security logging across all NGFWs in your tenant by opening a [support case](https://support.paloaltonetworks.com/Support/Index). If you would like to expedite the upgrade, please make a note of that in the support case.\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.2.2:h2:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.2.2:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.2.1:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.2.1:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.2.0:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.2.0:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.2:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h8:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h6:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h5:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h3:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h2:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h11:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h10:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h9:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h8:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h7:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h6:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h5:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h4:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h3:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h2:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.3:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h15:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h14:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h13:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h12:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h11:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h10:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h9:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h8:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h7:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h6:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h5:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h4:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h3:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h2:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.2:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.1:h2:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.1:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.1:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h4:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h3:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h2:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1.0:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:11.1:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h8:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h18:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h17:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h16:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h15:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h13:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h12:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h10:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h8:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h7:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h6:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h5:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h4:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h3:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h2:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h18:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h17:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h16:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h15:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h14:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h12:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h11:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h9:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h8:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h7:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h6:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h5:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h2:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.2:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h5:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h3:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h1:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:\\*:\\*:\\*:\\*:\\*:\\*\n\ncpe:2.3:o:paloaltonetworks:pan-os:10.1:-:\\*:\\*:\\*:\\*:\\*:\\*", "description_format": "markdown", "vulnerability": "CVE-2024-3393", "creation_timestamp": "2024-12-27T08:59:02.439757+00:00", "timestamp": "2024-12-27T08:59:47.544807+00:00", "related_vulnerabilities": ["CVE-2024-3393"], "meta": [{"tags": ["vulnerability:information=remediation"]}], "author": {"login": "adulau", "name": "Alexandre Dulaunoy", "uuid": "c933734a-9be8-4142-889e-26e95c752803"}}