What is PAN-SA-2016-0008?

PAN-SA-2016-0008 is a security advisory published by Palo Alto Networks Security Advisories with Medium severity. PAN-SA-2016-0008 PAN-OS API denial of service

Why does PAN-SA-2016-0008 have no CVE ID yet?

Palo Alto Networks Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by PAN-SA-2016-0008?

PAN-SA-2016-0008 affects 1 product, including: PAN-OS.

PAN-SA-2016-0008MediumDisclosed before NVD

PAN-SA-2016-0008 PAN-OS API denial of service

Vendor

Palo Alto Networks Security Advisories

Published

June 27, 2016

Last Modified

June 27, 2016

📋 Description

Palo Alto Networks firewalls offer an API to query and modify the configuration of the device. While access to this API is protected by the use of an API key, an issue was recently identified leading to a potential unauthenticated denial of service attack. (Ref #91728) The API is hosted on a dedicated management interface and, while this issue can result in a DoS attack of the API, it doesn’t compromise the security functionality of the device. This issue affects PAN-OS 7.0.1 to PAN-OS 7.0.7

🎯 Affected products1

PAN-OS

✅ Remediation

PAN-OS 7.0.8 and later Workarounds and mitigations: Exploitation of this issue is only available to personnel with access to the management interface on the device. Palo Alto Networks recommends the following best practice implementation: deploy the management interface on an out-of-band network and separate from inline traffic processing.

🔗 References (1)

advisoryhttps://security.paloaltonetworks.com/PAN-SA-2016-0008