PAN-OS: Denial of Service in Advanced DNS Security Feature
A denial-of-service (DoS) vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.
Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
VERSION MINOR VERSION SUGGESTED SOLUTION
Cloud NGFW All No action needed.
PAN-OS 12.1 12.1.2 through 12.1.3 Upgrade to 12.1.4 or later.
PAN-OS 11.2 11.2.0 through 11.2.9 Upgrade to 11.2.10 or later.
PAN-OS 11.1 No action needed.
PAN-OS 10.2 No action needed.
All older Upgrade to a supported fixed version.
unsupported
PAN-OS versions
Prisma Access All No action needed.
Configurations
The firewall must have Advanced DNS Security (ADNS) enabled and a spyware profile with actions configured to block, sinkhole, or alert (i.e., any non-allow value).
Workarounds
No known workarounds exist for this issue. Due to the nature of this vulnerability, a Threat Prevention Signature to detect this is also not possible.
Exploits
Palo Alto Networks is not aware of any malicious exploitation of this issue.