Critical Out-of-Bounds Write Vulnerability in Palo Alto Networks PAN-OS

What changed

Palo Alto Networks has disclosed a significant out-of-bounds write vulnerability in its PAN-OS software. This issue affects the User-ID™ Authentication Portal, enabling unauthenticated attackers to execute arbitrary code with root privileges on affected devices.

The vulnerability arises from a buffer overflow condition that can be exploited by sending specially crafted packets to the service.

Who is affected

The vulnerability primarily impacts the following products:

Organizations using the PA-Series and VM-Series firewalls are at risk, particularly if they have not restricted access to the User-ID™ Authentication Portal.

• PA-Series firewalls from Palo Alto Networks
• VM-Series firewalls from Palo Alto Networks
• Any organization utilizing the User-ID™ Authentication Portal without proper access restrictions

What to do

To mitigate the risk associated with this vulnerability, it is crucial for organizations to follow best practice guidelines. Securing access to the User-ID™ Authentication Portal can significantly reduce the threat.

Restricting access to trusted internal IP addresses is recommended to prevent unauthorized exploitation of this vulnerability.

• Implement access controls to limit the User-ID™ Authentication Portal to trusted internal IP addresses.
• Regularly review and update firewall configurations to align with security best practices.
• Stay informed about updates from Palo Alto Networks regarding this vulnerability.