CVE-2024-9468: PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet (Severity: HIGH)
First published: Wed Oct 09 2024(Updated: )
A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.
Credit: psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Palo Alto Networks PAN-OS | <10.2.9-h11=10.2<11.0.4-h5=11.0<11.1.3=11.1 | 10.2.9-h11 10.2.10-h4 10.2.11 11.0.4-h5 11.0.6 11.1.3 |
| Palo Alto Networks Cloud NGFW | ||
| Palo Alto Networks Prisma Access |
Remedy
This issue is fixed in 10.2.9-h11, 10.2.10-h4, PAN-OS 10.2.11, PAN-OS 11.0.4-h5, PAN-OS 11.0.6, PAN-OS 11.1.3, and all later PAN-OS versions.
Remedy
Customers can block attacks for this vulnerability by disabling this setting: Device > Setup Session > Decryption Settings > SSL Decryption Settings > Send handshake messages to CTD for inspection. Customers with a Threat Prevention subscription, who want to keep domain fronting detection enabled, can block attacks for this vulnerability by enabling Threat ID 94971 (introduced in Applications and Threats content version 8854).
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-9468?
CVE-2024-9468 is categorized as a denial of service (DoS) vulnerability due to memory corruption in Palo Alto Networks PAN-OS.
How do I fix CVE-2024-9468?
To mitigate CVE-2024-9468, upgrade to the latest patched version of PAN-OS recommended by Palo Alto Networks.
Who is affected by CVE-2024-9468?
CVE-2024-9468 affects users of Palo Alto Networks PAN-OS versions up to 10.2.9-h11, 11.0.4-h5, and specific versions of Cloud NGFW and Prisma Access.
What is the impact of CVE-2024-9468?
Exploitation of CVE-2024-9468 can lead to an attacker being able to crash PAN-OS, causing a denial of service condition.
Is CVE-2024-9468 remotely exploitable?
Yes, CVE-2024-9468 can be exploited remotely by an unauthenticated attacker.
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/author
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/paloaltonetworks-latest
- source/Palo Alto Networks
- agent/title
- agent/severity
- agent/remedy
- agent/first-publish-date
- agent/event
- collector/paloaltonetworks-api
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/trending
- agent/tags
- agent/epss
- collector/epss-latest
- source/FIRST
- agent/source
- vendor/palo alto networks
- canonical/palo alto networks pan-os
- version/palo alto networks pan-os/10.2
- version/palo alto networks pan-os/11.0
- version/palo alto networks pan-os/11.1
- canonical/palo alto networks cloud ngfw
- canonical/palo alto networks prisma access