cbcvebase.
CVE-2017-8390
published 2017-08-02

CVE-2017-8390: The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute…

PriorityP260critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
6.07%
92.5th percentile
The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via a crafted domain name.

Affected

32 ranges· showing 25
VendorProductVersion rangeFixed in
paloaltopan-os——
paloaltonetworkspan-os<= 6.1.17—
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——
paloaltonetworkspan-os——

Detection & IOCsextracted from sources · hover to see the quote

  • →Exploitation targets the PAN-OS DNS Proxy component; monitor for anomalous or malformed DNS queries (specially crafted FQDNs) directed at PAN-OS devices with DNS Proxy enabled ↗
  • →Both the Data plane and Management plane of the firewall are affected attack surfaces; monitor for unexpected process crashes or code execution events on both planes of PAN-OS devices ↗
  • →Scope detection to PAN-OS versions 6.1.17 and earlier, 7.0.15 and earlier, 7.1.9 and earlier, and 8.0.2 and earlier — these are the confirmed vulnerable version ranges ↗
  • ·Vulnerability only affects deployments where DNS Proxy is explicitly enabled in PAN-OS; verify DNS Proxy configuration status before prioritising remediation ↗
  • ·Disabling DNS Proxy is the recommended workaround for devices that cannot be immediately patched ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.