CVE-2024-3384 is a high-severity vulnerability affecting Palo Alto Networks PAN-OS software, specifically impacting PAN-OS firewalls. This vulnerability allows remote attackers to reboot the firewalls by sending malformed NTLM packets from Windows servers. Repeated attacks can force the firewall into maintenance mode, requiring manual intervention to restore functionality. The issue affects systems with NTLM authentication enabled and has been addressed in later PAN-OS versions.

How do I know if I'm affected?

To determine if you're affected by the CVE-2024-3384 vulnerability, check if you're using Palo Alto Networks PAN-OS software with NTLM authentication enabled. Affected versions include PAN-OS 10.0.12 and earlier, PAN-OS 9.1.15-h1 and earlier, PAN-OS 9.0.17 and earlier, and PAN-OS 8.1.24 and earlier. If your system matches these criteria, it may be vulnerable to this issue.

What should I do if I'm affected?

If you're affected by the CVE-2024-3384 vulnerability, update your PAN-OS software to a fixed version, such as PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.15-h1, or PAN-OS 10.0.12. This will help mitigate the issue and protect your firewall from potential attacks.

Is CVE-2024-3384 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-3384 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This issue, discovered in Palo Alto Networks PAN-OS software, allows attackers to reboot firewalls by sending specific packets, potentially forcing the firewall into maintenance mode and requiring manual intervention. The vulnerability was added to the NVD on April 10, 2024, and a solution is available in fixed PAN-OS versions.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-1286, which involves improper validation of input syntax, making firewalls susceptible to attacks.

For more details

CVE-2024-3384 is a significant vulnerability in Palo Alto Networks PAN-OS software, affecting firewalls with NTLM authentication enabled. For a comprehensive understanding of this vulnerability, including its description, severity, and technical details, refer to the NVD and the link listed below.

• Palo Alto Networks Security Advisory