CVE-2024-3384: PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets
First published: Wed Apr 10 2024(Updated: )
A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online.
Credit: psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Palo Alto Networks PAN-OS | >=8.1.0<8.1.24 | |
| Palo Alto Networks PAN-OS | >=9.0.0<9.0.17 | |
| Palo Alto Networks PAN-OS | >=9.1.0<9.1.15 | |
| Palo Alto Networks PAN-OS | >=10.0.0<10.0.12 | |
| Palo Alto Networks PAN-OS | =9.1.15 | |
| Palo Alto PAN-OS |
Remedy
This issue is fixed in PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.15-h1, PAN-OS 10.0.12, and all later PAN-OS versions.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-3384?
CVE-2024-3384 is classified as a high severity vulnerability due to its potential impact on the availability of PAN-OS firewalls.
How do I fix CVE-2024-3384?
To fix CVE-2024-3384, upgrade your PAN-OS to a version that is not affected, specifically versions 8.1.25, 9.0.18, 9.1.16, or 10.0.13 and later.
What systems are affected by CVE-2024-3384?
CVE-2024-3384 affects Palo Alto Networks PAN-OS versions 8.1.0 to 8.1.24, 9.0.0 to 9.0.17, 9.1.0 to 9.1.15, and 10.0.0 to 10.0.12.
What can attackers do with CVE-2024-3384?
Attackers can remotely reboot PAN-OS firewalls by sending malicious NTLM packets, causing disruption in network services.
Is there a workaround for CVE-2024-3384?
Currently, there are no documented workarounds for CVE-2024-3384 other than updating to a secure version.
- agent/weakness
- agent/title
- agent/references
- agent/remedy
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- vendor/paloaltonetworks
- canonical/palo alto networks pan-os
- version/palo alto networks pan-os/8.1.0
- version/palo alto networks pan-os/9.0.0
- version/palo alto networks pan-os/9.1.0
- version/palo alto networks pan-os/10.0.0
- version/palo alto networks pan-os/9.1.15
- vendor/palo alto networks
- canonical/palo alto pan-os