topic Re: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface in Next-Generation Firewall Discussions

CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

V.Benfanti — Mon, 18 Nov 2024 15:37:17 GMT

Hello!
I just received and was reading this email CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface and if I'm reading it right, the guidance is to upgrade to 10.2.12-h2 or greater (I'm on a PA-220, 11 is not supported). I've been trying to stick with the Preferred versions here Support PAN-OS Software Release Guidance and the latest Preferred version is 10.2.10-h7 which I believe is vulnerable. Do I have that right??? Thanks!

Re: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

SeSchulte — Mon, 18 Nov 2024 16:23:57 GMT

Hello V. Benfanti,

On the one hand, you have to stay in the 10.2 tree with the PA-220, as this is the last version that supports the hardware platform.
Furthermore, the bug in 10.2.10-h7 is not yet fixed and you would have to switch to a fixed version at this point, in this case 10.2.12-h2.
Alternatively, please check whether you have followed the best practice regarding the protection of MGMT interfaces.
See here: https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431
As you can reduce the CVE to a 5.9.

Furthermore, please check if you have installed the Conntent version 8915-9075, so that the attacks can be recognized by the firewall (Threat IDs 95746, 95747, 95752, 95753, 95759, and 95763).

Best regards

Re: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

Ecaballero — Tue, 19 Nov 2024 18:06:04 GMT

IS Pan OS 9.1 vulnerable? The advisory does not state.

Re: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

BPry — Tue, 19 Nov 2024 18:15:23 GMT

@Ecaballero,

It seems likely that it is since this covers all presently supported versions of PAN-OS. Since 9.1 is EoL and the PA-3000 series also went EoL here a couple of weeks ago there's zero support for that build anymore. I'd highly recommend that you secure the management port and getting that equipment replaced.

Re: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

iarobertson — Tue, 19 Nov 2024 22:58:00 GMT

Hello @Ecaballero - PanOS 9.1 is not vulnerable to this issue. However it is strongly advised to move off 9.1 as this is no longer a supported release.