Palo Alto Networks PAN-OS 7.1.x < 7.1.24 / 8.0.x < 8.0.19 / 8.1.x < 8.1.8-h5 / 9.0.x < 9.0.2-h4 Multiple Vulnerabilities

High Nessus Plugin ID 129302

Synopsis

The remote PAN-OS host is affected by multiple vulnerabilities

Description

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 7.1.24 or 8.0.x prior to 8.0.19 or 8.1.x prior to 8.1.8-h5 or 9.0.x prior to 9.0.2-h4. It is, therefore, affected by multiple vulnerabilities.

- An integer overflow condition exists in Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. An unauthenticated, remote attacker can exploit this, via by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS) to cause a crash Linux kernel.(CVE-2019-11477)

- An excessive resource consumption flaw was found in the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. An unauthenticated, remote attacker can exploit this, via by sending a crafted sequence of SACK segments on a TCP connection, to cause a denial of service condition. (CVE-2019-11478)

- An excessive resource consumption flaw was found in the Linux kernel's networking subsystem processed TCP segments.
An unauthenticated, remote attacker can exploit this, via repeatedly sending network traffic on TCP connection with low TCP MSS, resulting in a denial of service (Dos). (CVE-2019-11479)

Solution

Upgrade to PAN-OS 7.1.24 / 8.0.19 / 8.1.8-h5 / 9.0.2-h4 or later

See Also

https://securityadvisories.paloaltonetworks.com/Home/Detail/151

Plugin Details

Severity: High

ID: 129302

File Name: palo_alto_PAN-SA-2019-0013.nasl

Version: 1.1

Type: local

Published: 2019/09/25

Updated: 2019/09/25

Dependencies: 72816

Risk Information

Risk Factor: High

CVSS Score Source: CVE-2019-11477

CVSS v2.0

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS v3.0

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: cpe:/o:paloaltonetworks:pan-os

Required KB Items: Host/Palo_Alto/Firewall/Version, Host/Palo_Alto/Firewall/Full_Version

Patch Publication Date: 2019/06/27

Vulnerability Publication Date: 2019/06/19

Reference Information

CVE: CVE-2019-11477, CVE-2019-11478, CVE-2019-11479

BID: 108801, 108798, 108818