Kernel Vulnerability (PAN-SA-2017-0015)

Last revised: 06/19/2017


A vulnerability exists in the kernel of PAN-OS that may result in Information Disclosure. The challenge ACK rate limiting in the kernel's networking subsystem may allow an off-path attacker to leak certain information about a given connection by creating congestion on the global challenge ACK rate limit counter and then measuring the changes by probing packets. (ref # PAN-62500 / CVE-2016-5696).

Severity: Medium

Successful exploitation of this issue may allow an attacker to terminate a TCP connection or inject a payload into non-secured TCP connection between two endpoints on the network.

Products Affected

PAN-OS 6.1, PAN-OS 7.0.15 and earlier, PAN-OS 7.1.9 and earlier

Available Updates

PAN-OS 7.0.16 and later, PAN-OS 7.1.10 and later

Workarounds and Mitigations