Regarding Security Advisory CVE-2024-3393

[MRamadanAHafiez]

Hello Team,

   I have recently upgraded my pa-1410 firewall to panos ver. 11.1.4-h7, because its preferred version so far.

Today I have received this advisory link ...

https://securityadvisories.paloaltonetworks.com/CVE-2024-3393

I have DNS Security enabled.

Things are not clear to take an action, what id action required? I can see my version listed as fixed, or it should be patched by Tac.

What do you think?

TIA.

[mshekh · Accepted solution]

Hi @MRamadanAHafiez 

PAN-OS 11.1.4-h7 has fix for this CVE-2024-3393 so you don't need to do anything if you are running PAN-OS 11.1.4-h7

https://securityadvisories.paloaltonetworks.com/CVE-2024-3393

[MRamadanAHafiez]

Thank you so much @mshekh .

I posted thus because the advisory stated the nersion as its fixed and still listed down in the CPEs. 😀

You've confirmed my findings.

[Marcel_Giquel]

Hi @MShekh

I have Palo's on 10.2.8-h15 . Does this 10.2.8-h15 version has the fix for CVE-2024-3393?

Thanks for your help.

[mshekh]

Hi @Marcel_Giquel 

No Fix is not included in PAN-OS 10.2.8-h15 for CVE-2024-3393. Please refer the below link for fixed versions

.

https://security.paloaltonetworks.com/CVE-2024-3393

[Omar-Khouli]

Hello Team @mshekh ,

Please advise if version 10.2.7-h3 affected with this CVE or not? 

Thanks

[plau]

Do the firewalls need the DNS Security license to be affected? Or are all firewalls with DNS logging enabled affected? We are trying to determine scope and not all our firewalls have the DNS Security license.

[OtakarKlier]

Hello All,

Please read the documentation:

So 11.1.4-h7 is affected. 10.2.8-h15 is not affected. 10.2.7-h3 is affected. There is a mitigation prior to upgrade:

https://securityadvisories.paloaltonetworks.com/CVE-2024-3393#:~:text=Workarounds%20and%20Mitigation...

The vulnerability is in the Anti-Spyware DNS logging section.

Regards,

[T.Bullock]

I have the same scenario as well. Please let me know if you get some clarity on whether customers in the same situation are vulnerable.

[MRamadanAHafiez]

Hi @OtakarKlier I posted this discusion because it was not clear.

It saied any ver below 11.1.5, the it says versions with fix and 11.1.4-h7 listed, and this version still listed in the CPEs field.

[OtakarKlier]

Interesting they put it there and not in the main graphic. I stand corrected.

[OtakarKlier]

Great question. The mitigation only refers to the Anti-Spyware signatures and doesnt mention Secure DNS. Maybe TAC has an answer?

[T.Bullock]

I am going to open a case. I will post their response.

[MRamadanAHafiez]

I will open a case and post the answers too, thank you.

[Mattias_Sauer]

I opened a ticket at Palo Alto support. PA Version 11.1.4-h7 is already patched and not affected by CVE-2024-3393.

Extract from the support ticket:

Is the PA version 11.1.4-h7 already protected against the new CVE-2024-3393?
- Yes , version 11.1.4-h7 protected against the new CVE-2024-3393.