Denial of service in Palo Alto PAN-OS

1) Input validation error

EUVDB-ID: #VU55823

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3048

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and configuration changes even though the firewall remains otherwise functional. If the firewall then restarts, it results in a denial-of-service (DoS) condition and the firewall stops processing traffic.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Palo Alto PAN-OS: 9.0.0 - 10.0.4

CPE2.3

• cpe:2.3:o:palo_alto_networks:pan-os:9.0.13:*:*:*:*:*:*:
• cpe:2.3:o:palo_alto_networks:pan-os:9.1.8:*:*:*:*:*:*:
• cpe:2.3:o:palo_alto_networks:pan-os:10.0.4:*:*:*:*:*:*:

External links

http://security.paloaltonetworks.com/CVE-2020-3048

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.