Vulnerability in the PAN-OS DNS Proxy (PAN-SA-2017-0021)

Last revised: 07/20/2017


A Remote Code Execution vulnerability exists in the PAN-OS DNS Proxy. This issue affects customers who have DNS Proxy enabled in PAN-OS. This issue affects both the Data and Management planes of the firewall. When DNS Proxy processes a specially crafted fully qualified domain names (FQDN), it is possible to execute code on the firewall. (ref # PAN-77516 / CVE-2017-8390).

Severity: Critical

Successful exploitation of this issue could allow an attacker to execute code on the firewall.

Products Affected

PAN-OS 6.1.17 and earlier, PAN-OS 7.0.15 and earlier, PAN-OS 7.1.9 and earlier, PAN-OS 8.0.2 and earlier

Available Updates

PAN-OS 6.1.18 and later, PAN-OS 7.0.16 and later, PAN-OS 7.1.10 and later, PAN-OS 8.0.3 and later

Workarounds and Mitigations

Palo Alto Networks recommends disabling DNS Proxy for those customers who are affected and are unable to apply the update.