PTA Issues Cyber Alert Against Vulnerabilities in Internet Firewall Software

PTA has issued a cyber security advisory titled “Zero-Day Alert: Critical Palo Alto Networks PAN-OS Flaw Under Active Attack.”

The advisory highlights a significant vulnerability, identified as CVE-2024-3400, in Palo Alto Networks’ PAN-OS software, widely used in Global Protect gateways. This flaw grants unauthenticated attackers the ability to execute arbitrary code with root privileges on the affected firewalls, posing a severe risk to systems utilizing this software.

According to the advisory, the vulnerability affects specific versions of PAN-OS, including versions below 11.1.2-h3, 11.0.4-h1, and 10.2.9-h1. Palo Alto Networks is expected to release critical fixes for these vulnerabilities on April 14, 2024. Organizations utilizing these software versions are urged to take immediate precautions to mitigate the risk of exploitation.

PTA advises customers with a Threat Prevention subscription to enable Threat ID 95187 as a protective measure against the potential exploitation of this flaw. The advisory also recommends a thorough review of configurations for both Global Protect gateway and device telemetry, ensuring that only necessary features are activated. Continuous monitoring and the use of intrusion detection systems are emphasized to detect any suspicious activity that may indicate an exploitation attempt.

Further, the PTA advises restricting access to affected firewalls and applying the principle of least privilege to minimize the impact of any potential attacks. Organizations are also encouraged to stay updated on security advisories and patches released by Palo Alto Networks to address new threats and vulnerabilities as they emerge.

PTA requests that any incidents related to this vulnerability be reported through the PTA CERT Portal or via email. According to PTA, this proactive communication is crucial for the timely mitigation of risks and the safeguarding of Pakistan’s cyber infrastructure.