Get supportSecurity advisories
Report vulnerabilities
Palo Alto Networks Security Advisories / CVE-2017-8390

CVE-2017-8390 Vulnerability in the PAN-OS DNS Proxy

Severity 9.8 · CRITICAL
Attack Vector NETWORK
Attack Complexity LOW
Privileges Required NONE
User Interaction NONE
Confidentiality Impact HIGH
Integrity Impact HIGH
Availability Impact HIGH
Published: 2017-07-20
Updated: 2017-07-20
Ref#: PAN-77516 PAN-SA-2017-0021


A Remote Code Execution vulnerability exists in the PAN-OS DNS Proxy. This issue affects customers who have DNS Proxy enabled in PAN-OS. This issue affects both the Data and Management planes of the firewall. When DNS Proxy processes a specially crafted fully qualified domain names (FQDN), it is possible to execute code on the firewall. (ref # PAN-77516 / CVE-2017-8390).

Successful exploitation of this issue could allow an attacker to execute code on the firewall.

This issue affects PAN-OS 6.1.17 and earlier, PAN-OS 7.0.15 and earlier, PAN-OS 7.1.9 and earlier, PAN-OS 8.0.2 and earlier

Product Status


6.1<= 6.1.17>= 6.1.18
7.0<= 7.0.15>= 7.0.16
7.1<= 7.1.9>= 7.1.10
8.0<= 8.0.2>= 8.0.3

Severity: CRITICAL

CVSSv3.1 Base Score: 9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )


PAN-OS 6.1.18 and later, PAN-OS 7.0.16 and later, PAN-OS 7.1.10 and later, PAN-OS 8.0.3 and later

Workarounds and Mitigations

Palo Alto Networks recommends disabling DNS Proxy for those customers who are affected and are unable to apply the update.

© 2020 Palo Alto Networks, Inc. All rights reserved.