Palo Alto Security Updates – 14 September 2023

The addressed vulnerabilities could allow the attacker to cause denial of service
attacks on the affected products, or allow the local user to disable the Cortex XDR
agent on the vulnerable Windows devices.

The addressed vulnerabilities:

1. PAN-OS: Denial-of-Service Vulnerability in BGP Software (CVE-2023-38802):

• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Denial of Service

2. Cortex XDR Agent Protection Mechanism in Windows Devices (CVE-2023- 3280):

• CVSS: 5.5
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Denial of Service

Affected Versions:

• Cortex XDR Agent 8.0 < 8.0.2 on Windows.
• Cortex XDR Agent 7.9-CE < 7.9.101-CE on Windows.
• Cortex XDR Agent 7.9 < 7.9.3 on Windows.
• Cortex XDR Agent 7.5-CE All on Windows.
• Cortex XDR Agent 5.0 All on Windows.
• PAN-OS 11.0 < 11.0.3.
• PAN-OS 10.2 < 10.2.6.
• PAN-OS 10.1 < 10.1.11.
• PAN-OS 9.1 <= 9.1.16.

It should be highlighted that the issues affecting PAN-OS products will be fixed in a new PAN-OS 9.1.16 hotfix (ETA: Week of 10/02), PAN-OS 10.1.11 (ETA: Week of 09/25), PAN-OS 10.2.6 (ETA: Week of 09/25), PAN-OS 11.0.3 (ETA: Week of 10/16), and all later PAN-OS versions. Also, there’s no fix planned for this issue for PANOS 8.1, PAN-OS 9.0, PAN-OS 10.0, and other end-of-life (EoL) PAN-OS versions.