Vulnerability in PA?

[BigPalo]

Hi,

We just received info about this vulneraability:

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md

So we would like to know if PA appliances are impacted?

Thanks

[Remo]

Hi @BigPalo 

I have opened a case to ask for this information.

[Remo]

3 hours and this high priority case is still in the support queue ...

[Remo]

The PAN-OS team is curently investigating ... as soon more informations become available I assume PaloAlto will also write an official public statement.

[rkazala]

Plesase let us know if you hear back from support!

[BigPalo]

Please, let me know the response from TAC.

[Remo]

As soon as I receive more information I'll write an update here ...

(This is NOT official: I can not imagine that Paloalto is not affected by this)

[BigPalo]

We will wait until TAC response. Thanks

[RobinClayton]

For Reference.

https://nvd.nist.gov/vuln/detail/CVE-2019-11477

https://nvd.nist.gov/vuln/detail/CVE-2019-11478

https://nvd.nist.gov/vuln/detail/CVE-2019-11479

[BigPalo]

Any update about Palo Alto TAC?

[Remo]

Unfortunately still no news here ... I asked again ...

[Remo]

TAC still did not answer in my support case. But for PAN-OS 7.1 an update (7.1.24) was released some minutes ago where these vulnerabilities are fixed. Because of that I am even more sure that these vulnerabilties also affect the newer PAN-OS versions. I assume in the next hours/days updates for PAN-OS 8.0/8.1 and 9.0 will be released...

[Remo]

And just now the fixes for 8.0 in versino 8.0.19 were released: https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-release-notes/pan-os-8-0-addressed-issues/pan-os...

[Remo]

and also fixed for PAN-OS 8.1 in version 8.1.8-h5: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-release-notes/pan-os-8-1-addressed-issues/pan-os...

[BPry]

Just to go full circle, a fix is also present in 9.0.2-h5 for whoever has jumped the gravy train and is running 9.0 in a production environment.