CVE-2022-0023 : Security Advisory and Response

A denial-of-service vulnerability has been discovered in the DNS proxy feature of Palo Alto Networks PAN-OS software, potentially allowing a meddler-in-the-middle to disrupt firewall services.

Understanding CVE-2022-0023

This CVE highlights an improper handling of exceptional conditions vulnerability within PAN-OS software's DNS proxy feature, impacting multiple versions.

What is CVE-2022-0023?

The vulnerability enables a meddler-in-the-middle to send crafted traffic, leading to unexpected service restarts, ultimately causing denial-of-service to PAN-OS services.

The Impact of CVE-2022-0023

The vulnerability affects PAN-OS versions less than 8.1.22, 9.0.16, 9.1.13, 10.0.10, and 10.1.5. It does not impact 10.2 versions, but can restart affected devices in maintenance mode, disrupting services.

Technical Details of CVE-2022-0023

The vulnerability's technical details include vulnerability descriptions, affected systems and versions, and the exploitation mechanism.

Vulnerability Description

An improper handling of exceptional conditions in the DNS proxy feature allows an attacker to disrupt firewall services and cause denial-of-service incidents.

Affected Systems and Versions

PAN-OS versions earlier than 8.1.22, 9.0.16, 9.1.13, 10.0.10, and 10.1.5 are vulnerable to this denial-of-service issue.

Exploitation Mechanism

The vulnerability enables a meddler-in-the-middle to exploit the DNS proxy feature, causing unexpected service restarts and disrupting PAN-OS services.

Mitigation and Prevention

To mitigate the risks associated with CVE-2022-0023, immediate steps should be taken along with long-term security practices and timely patching.

Immediate Steps to Take

Customers with a Threat Prevention subscription can block attack traffic related to this vulnerability by enabling Threat ID 92406. It is recommended to temporarily disable the DNS proxy feature until updating to a patched PAN-OS version.

Long-Term Security Practices

Implement robust firewall configurations, conduct regular security audits, and train staff on cybersecurity best practices to enhance overall network security.

Patching and Updates

Ensure that your PAN-OS software is updated to version 8.1.22, 9.0.16, 9.1.13, 10.0.10, 10.1.5, or any later versions to prevent exploitation of the vulnerability.