Palo Alto Networks PAN-OS up to 10.1.11/10.2.7-h2/11.0.3 inadequate encryption

Summaryinfo

A vulnerability marked as problematic has been reported in Palo Alto Networks PAN-OS up to 10.1.11/10.2.7-h2/11.0.3. Impacted is an unknown function. The manipulation leads to inadequate encryption. This vulnerability is listed as CVE-2024-3387. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Palo Alto Networks PAN-OS up to 10.1.11/10.2.7-h2/11.0.3. It has been rated as problematic. This issue affects an unknown code. The manipulation with an unknown input leads to a inadequate encryption vulnerability. Using CWE to declare the problem leads to CWE-326. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. Impacted is confidentiality. The summary by CVE is:

A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls.

The weakness was presented by One. It is possible to read the advisory at security.paloaltonetworks.com. The identification of this vulnerability is CVE-2024-3387 since 04/05/2024. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

Upgrading to version 10.1.12, 10.2.7-h3, 10.2.8, 11.0.4 or 11.1.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Palo Alto Networks

Name

• PAN-OS

Version

• 10.1.0
• 10.1.1
• 10.1.2
• 10.1.3
• 10.1.4
• 10.1.5
• 10.1.6
• 10.1.7
• 10.1.8
• 10.1.9
• 10.1.10
• 10.1.11
• 10.2.7-h1
• 10.2.7-h2
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion