Palo Alto Networks Releases Security Updates for PAN-OS Vulnerability

Security update addresses CVE-2022-0028, a reflected amplification denial-of-service vulnerability in URL filtering

Threat ID:: CC-4147
Threat Severity:: Information only
Published:: 11 August 2022 12:53 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update addresses CVE-2022-0028, a reflected amplification denial-of-service vulnerability in URL filtering

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 10.2.2-h2, all prior to 10.1.6-h6, all prior to 10.0.11-h1, all prior to 9.1.14-h4, all prior to 9.0.16-h3, all prior to 8.1.23-h1

Palo Alto Networks PAN-OS

Cloud NGFW and Prisma Access 3.1, 3.0, 2.2, and 2.1 are unaffected

Threat details

Introduction

Palo Alto Networks released security updates to address a vulnerability affecting the PAN-OS firewall operating system. A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks that could obfuscate the identity of the attacker and implicate the firewall as the source of the attack.

Exploitation in the wild for CVE-2022-0028

Palo Alto Networks have reported that there has been exploitation in the wild for the vulnerability known as CVE-2022-0028

Affected organisations are still encouraged to review Palo Alto advisory and apply any relevant updates.

Remediation advice

Affected organisations are encouraged to review the Palo Alto advisory CVE-2022-0028 PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering and apply any relevant updates.

Definitive source of threat updates

https://security.paloaltonetworks.com/CVE-2022-0028

CVE Vulnerabilities

Status Published

CVE-2022-0028

A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.

Last edited: 15 August 2022 5:11 pm