topic Re: Malicious Traffic related to CVE-2024-9472 and CVE-2024-3393 DoS Vulnerabilities. in Advanced Threat Prevention Discussions

Malicious Traffic related to CVE-2024-9472 and CVE-2024-3393 DoS Vulnerabilities.

L.Avendano — Fri, 03 Jan 2025 21:22:14 GMT

Can anyone share any technical insight into what the attack payload might be or you may be observing in your Threat logs?
We have found some malformed DNS packet sent to port 53 that the FW labels as MS Windows NAT Helper DNS Query DoS Vulnerability (31339)
These packets contain a NULL Pointer Dereference payload that we think is triggering the vulnerabilities.

Any technical insight from the community is appreciated. Thank you.

Re: Malicious Traffic related to CVE-2024-9472 and CVE-2024-3393 DoS Vulnerabilities.

Mudhireddy — Sat, 04 Jan 2025 20:22:09 GMT

This issue is already resolved.
https://live.paloaltonetworks.com/t5/general-topics/regarding-security-advisory-cve-2024-3393/td-p/999701

https://nvd.nist.gov/vuln/detail/CVE-2024-3393

Re: Malicious Traffic related to CVE-2024-9472 and CVE-2024-3393 DoS Vulnerabilities.

L.Avendano — Sat, 04 Jan 2025 22:34:53 GMT

Yup! Yup! I know there’s a fix for these. I’m more interested in what the attack payload is thats causing the NULL pointer bug to trip the process.