Palo Alto sees PHP2Shell attacks on PAN-OS, and all hotfixes are out
· Updated
- Affected
- PAN-OS
10.2through12.2on firewalls and Panorama before the hotfixes, and older, unsupported releases. All versions and fixes
Update, : Palo Alto’s advisory now lists 11.1.7-h12 as released, so every PAN-OS hotfix in its table is out.
Palo Alto Networks says it has seen active exploitation of the PHP flaws known as PHP2Shell, and , targeting PAN-OS management interfaces exposed to the internet. Its advisory listed five more PAN-OS hotfixes as released at 1:20 a.m. ET on Oct 29, and the last one, 11.1.7-h12, later that day. Palo Alto raised the flaws’ severity to critical on Oct 27.
Palo Alto doesn’t say how many devices were attacked or whether any attack succeeded. When only a jump box can reach the management interface, it now scores the flaws 7.7, up from 7.1 on Oct 26.
The Hacker News reported that Palo Alto added the exploitation statement to its advisory on Oct 28. Palo Alto’s advisory still lists Threat IDs for Threat Prevention subscribers, which protect the management interface only when its traffic is routed through a dataplane port, decrypted and inspected. Restricting management access to trusted internal addresses minimizes the risk, Palo Alto says.
Palo Alto says no special configuration is needed for a device to be affected. Customers with its Frontier Virtual Patching service on PAN-OS 12.2.4 and later have had coverage since Oct 20, through Threat ID 543004, Palo Alto says. For older, unsupported PAN-OS releases, it says to upgrade to a supported fixed release.
What to do
3 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| PAN-OS 12.2 | Releases before the hotfix | 12.2.4-h1 or later |
| PAN-OS 12.1 | Releases before the hotfixes | 12.1.4-h13, 12.1.7-h11 or 12.1.10-h3, by release |
| PAN-OS 11.2 | Releases before the hotfixes | 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4 or 11.2.16-h1, by release |
| PAN-OS 11.1 | Releases before the hotfixes | 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16 or 11.1.16-h4, by release |
| PAN-OS 10.2 | Releases before the hotfixes | 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12 or 10.2.18-h13, by release |
| Older PAN-OS releases | Unsupported releases | A supported release with its hotfix |
- Product
- PAN-OS 12.2
- Affected
- Releases before the hotfix
- Fixed
12.2.4-h1or later
- Product
- PAN-OS 12.1
- Affected
- Releases before the hotfixes
- Fixed
12.1.4-h13,12.1.7-h11or12.1.10-h3, by release
- Product
- PAN-OS 11.2
- Affected
- Releases before the hotfixes
- Fixed
11.2.4-h23,11.2.7-h23,11.2.10-h16,11.2.13-h4or11.2.16-h1, by release
- Product
- PAN-OS 11.1
- Affected
- Releases before the hotfixes
- Fixed
11.1.4-h38,11.1.6-h40,11.1.7-h12,11.1.10-h36,11.1.13-h16or11.1.16-h4, by release
- Product
- PAN-OS 10.2
- Affected
- Releases before the hotfixes
- Fixed
10.2.7-h39,10.2.10-h42,10.2.13-h27,10.2.16-h12or10.2.18-h13, by release
- Product
- Older PAN-OS releases
- Affected
- Unsupported releases
- Fixed
- A supported release with its hotfix
Timeline
- Oct 21Palo Alto publishes its advisory on the PHP flaws.
- Oct 27Palo Alto raises the flaws’ severity to critical.
- Oct 28Palo Alto adds that it has seen active exploitation, The Hacker News reports.
- Oct 29Palo Alto lists five more PAN-OS hotfixes as released.
- Oct 29Palo Alto lists
11.1.7-h12, the last PAN-OS hotfix, as released.
Sources
- Palo Alto Networks advisoryPrimary source security.paloaltonetworks.com
- The Hacker News news reportReporting thehackernews.com
Tags
Corrections
An earlier version of this story said every PAN-OS hotfix was out once Palo Alto listed five as released on Oct 29. One more,
11.1.7-h12, was still due until later that day.