PT-2017-2840 · Palo Alto Networks · Pan-Os

Published 2017-07-20 · Updated 2020-02-17 · CVE-2017-8390

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 6.1.17 and earlier Palo Alto Networks PAN-OS versions 7.0.15 and earlier Palo Alto Networks PAN-OS versions 7.1.9 and earlier Palo Alto Networks PAN-OS versions 8.0.2 and earlier

Description The issue is related to insufficient input validation in the DNS Proxy of the PAN-OS operating system. This allows a remote attacker to execute arbitrary code via a specially crafted domain name, specifically a fully qualified domain name (FQDN). The vulnerability affects both the Data and Management planes of the firewall. Successful exploitation could allow an attacker to execute code on the firewall.

Recommendations For versions 6.1.17 and earlier, update to version 6.1.18 or later. For versions 7.0.15 and earlier, update to version 7.0.16 or later. For versions 7.1.9 and earlier, update to version 7.1.11 or later. For versions 8.0.2 and earlier, update to version 8.0.3 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-02120

CVE-2017-8390

Affected Products

Pan-Os

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-8390 · Security Note
• https://bdu.fstec.ru/vul/2017-02120 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8390 · Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2017-8390 · Note
• http://securitytracker.com/id/1038976 · Note
• https://securityadvisories.paloaltonetworks.com/Home/Detail/91 · Note
• http://securityfocus.com/bid/99911 · Note