{"id":"CVE-2024-3384","state":"PUBLISHED","title":"PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets","description":"A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online.","publishedAt":"2024-04-10T17:06:21.704Z","updatedAt":"2024-08-01T20:12:06.484Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"palo_alto"},"assigner":"palo_alto","products":["Palo Alto Networks PAN-OS","Palo Alto Networks Cloud NGFW","Palo Alto Networks Prisma Access"],"affected":[{"vendor":"Palo Alto Networks","product":"PAN-OS","defaultStatus":"unaffected","versions":[{"version":"8.1.0","status":"affected","lessThan":"8.1.24","changes":[{"at":"8.1.24","status":"unaffected"}],"versionType":"custom"},{"version":"9.0.0","status":"affected","lessThan":"9.0.17","changes":[{"at":"9.0.17","status":"unaffected"}],"versionType":"custom"},{"version":"9.1.0","status":"affected","lessThan":"9.1.15-h1","changes":[{"at":"9.1.15-h1","status":"unaffected"}],"versionType":"custom"},{"version":"10.0.0","status":"affected","lessThan":"10.0.12","changes":[{"at":"10.0.12","status":"unaffected"}],"versionType":"custom"},{"version":"10.1.0","status":"unaffected"},{"version":"10.2.0","status":"unaffected"},{"version":"11.0.0","status":"unaffected"},{"version":"11.1.0","status":"unaffected"}]},{"vendor":"Palo Alto Networks","product":"Cloud NGFW","defaultStatus":"unaffected","versions":[{"version":"All","status":"unaffected"}]},{"vendor":"Palo Alto Networks","product":"Prisma Access","defaultStatus":"unaffected","versions":[{"version":"All","status":"unaffected"}]}],"references":["https://security.paloaltonetworks.com/CVE-2024-3384"],"weaknesses":["CWE-1286"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/3xxx/CVE-2024-3384.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-3384","state":"PUBLISHED","datePublished":"2024-04-10T17:06:21.704Z","dateUpdated":"2024-08-01T20:12:06.484Z","assignerShortName":"palo_alto","assignerOrgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","dateReserved":"2024-04-05T17:40:17.390Z"},"containers":{"cna":{"title":"PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets","descriptions":[{"lang":"en","value":"A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online."}],"affected":[{"vendor":"Palo Alto Networks","product":"PAN-OS","defaultStatus":"unaffected","versions":[{"version":"8.1.0","status":"affected","lessThan":"8.1.24","changes":[{"at":"8.1.24","status":"unaffected"}],"versionType":"custom"},{"version":"9.0.0","status":"affected","lessThan":"9.0.17","changes":[{"at":"9.0.17","status":"unaffected"}],"versionType":"custom"},{"version":"9.1.0","status":"affected","lessThan":"9.1.15-h1","changes":[{"at":"9.1.15-h1","status":"unaffected"}],"versionType":"custom"},{"version":"10.0.0","status":"affected","lessThan":"10.0.12","changes":[{"at":"10.0.12","status":"unaffected"}],"versionType":"custom"},{"version":"10.1.0","status":"unaffected"},{"version":"10.2.0","status":"unaffected"},{"version":"11.0.0","status":"unaffected"},{"version":"11.1.0","status":"unaffected"}]},{"vendor":"Palo Alto Networks","product":"Cloud NGFW","defaultStatus":"unaffected","versions":[{"version":"All","status":"unaffected"}]},{"vendor":"Palo Alto Networks","product":"Prisma Access","defaultStatus":"unaffected","versions":[{"version":"All","status":"unaffected"}]}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3384"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1286","description":"CWE-1286 Improper Validation of Syntactic Correctness of Input","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"palo_alto","orgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","dateUpdated":"2024-04-10T17:06:21.704Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"This issue affects only PAN-OS configurations with NTLM authentication enabled. You should verify whether NTLM authentication is enabled by checking your firewall web interface (Device > User Identification > User Mapping > Palo Alto Networks User-ID Agent Setup > NTLM)."}],"value":"This issue affects only PAN-OS configurations with NTLM authentication enabled. You should verify whether NTLM authentication is enabled by checking your firewall web interface (Device > User Identification > User Mapping > Palo Alto Networks User-ID Agent Setup > NTLM)."}],"credits":[{"lang":"en","type":"finder","value":"Palo Alto Networks thanks rqu for discovering and reporting this issue."}],"datePublic":"2024-04-10T16:00:00.000Z","exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Palo Alto Networks is not aware of any malicious exploitation of this issue.<br>"}],"value":"Palo Alto Networks is not aware of any malicious exploitation of this issue.\n"}],"impacts":[{"capecId":"CAPEC-153","descriptions":[{"lang":"en","value":"CAPEC-153 Input Data Manipulation"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"This issue is fixed in PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.15-h1, PAN-OS 10.0.12, and all later PAN-OS versions.<br>"}],"value":"This issue is fixed in PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.15-h1, PAN-OS 10.0.12, and all later PAN-OS versions.\n"}],"source":{"defect":["PAN-198992"],"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2024-04-10T16:00:00.000Z","value":"Initial publication"}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-3384","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-12T15:54:19.998958Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:32:38.411Z"}},{"title":"CVE Program Container","references":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3384","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:12:06.484Z"}}]}}}