A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS®…

#!/usr/bin/env python3
# check_cve_2026_0264.py
# Determine likely exposure to CVE-2026-0264 on a PAN-OS firewall over SSH.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 3=UNKNOWN, 4=USAGE/SSH ERROR

import sys
import re
import subprocess
import ipaddress

SSH_TIMEOUT = 20

FIX_RULES = {
    '12.1': [('12.1.2', '12.1.4-h4', '12.1.4-h5'), ('12.1.5', '12.1.6', '12.1.7')],
    '11.2': [('11.2.0', '11.2.4-h16', '11.2.4-h17'), ('11.2.5', '11.2.7-h12', '11.2.7-h13'), ('11.2.8', '11.2.10-h5', '11.2.10-h6'), ('11.2.11', '11.2.11', '11.2.12')],
    '11.1': [('11.1.0', '11.1.4-h32', '11.1.4-h33'), ('11.1.5', '11.1.6-h31', '11.1.6-h32'), ('11.1.7', '11.1.7-h5', '11.1.7-h6'), ('11.1.8', '11.1.10-h24', '11.1.10-h25'), ('11.1.11', '11.1.13-h4', '11.1.13-h5'), ('11.1.14', '11.1.14', '11.1.15')],
    '10.2': [('10.2.0', '10.2.7-h33', '10.2.7-h34'), ('10.2.8', '10.2.10-h35', '10.2.10-h36'), ('10.2.11', '10.2.13-h20', '10.2.13-h21'), ('10.2.14', '10.2.16-h6', '10.2.16-h7'), ('10.2.17', '10.2.18-h5', '10.2.18-h6')],
}

PRIVATE_NETS = [
    ipaddress.ip_network('10.0.0.0/8'),
    ipaddress.ip_network('172.16.0.0/12'),
    ipaddress.ip_network('192.168.0.0/16'),
    ipaddress.ip_network('127.0.0.0/8'),
    ipaddress.ip_network('169.254.0.0/16')
]

def parse_ver(v):
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)(?:-h(\d+))?$', v.strip())
    if not m:
        return None
    return tuple(int(x) if x is not None else 0 for x in m.groups())

def cmp_ver(a, b):
    pa, pb = parse_ver(a), parse_ver(b)
    if pa is None or pb is None:
        raise ValueError(f'Cannot compare versions: {a} vs {b}')
    return (pa > pb) - (pa < pb)

def in_range(ver, start, end):
    return cmp_ver(ver, start) >= 0 and cmp_ver(ver, end) <= 0

def is_affected(ver):
    branch = '.'.join(ver.split('.')[:2])
    rules = FIX_RULES.get(branch, [])
    for start, end, fixed in rules:
        if in_range(ver, start, end):
            return True, fixed
    return False, None

def run_ssh(target, commands):
    joined = '\n'.join(commands) + '\n'
    proc = subprocess.run(
        ['ssh', '-o', f'ConnectTimeout={SSH_TIMEOUT}', '-o', 'BatchMode=no', target],
        input=joined,
        text=True,
        capture_output=True
    )
    if proc.returncode != 0:
        print('UNKNOWN: SSH command failed')
        if proc.stderr:
            print(proc.stderr.strip())
        sys.exit(4)
    return proc.stdout

def is_private_ip(s):
    try:
        ip = ipaddress.ip_address(s)
        return any(ip in net for net in PRIVATE_NETS)
    except Exception:
        return False

def main():
    if len(sys.argv) != 2:
        print('UNKNOWN: usage: python3 check_cve_2026_0264.py [email protected]')
        sys.exit(4)

    target = sys.argv[1]

    sysinfo = run_ssh(target, ['set cli pager off', 'show system info', 'exit'])
    version_m = re.search(r'^sw-version:\s*(\S+)', sysinfo, re.M)
    model_m = re.search(r'^model:\s*(\S+)', sysinfo, re.M)

    if not version_m:
        print('UNKNOWN: could not determine PAN-OS version from show system info')
        sys.exit(3)

    version = version_m.group(1).strip()
    model = model_m.group(1).strip() if model_m else 'unknown'
    affected, fixed = is_affected(version)

    if not affected:
        print(f'PATCHED: version {version} is outside the documented vulnerable ranges for CVE-2026-0264')
        sys.exit(0)

    cfg = run_ssh(target, [
        'set cli pager off',
        'configure',
        'set cli config-output-format set',
        'show',
        'exit',
        'exit'
    ])

    dns_proxy_lines = [line for line in cfg.splitlines() if 'set network dns-proxy ' in line]
    iface_attach = [line for line in dns_proxy_lines if ' interface ' in line or re.search(r' ethernet\d+/\d+', line)]

    mgmt_dns = re.findall(r'set deviceconfig system dns-setting servers (?:primary|secondary) ([0-9]{1,3}(?:\.[0-9]{1,3}){3})', cfg)
    public_dns = [ip for ip in mgmt_dns if not is_private_ip(ip)]

    pa_series = model.lower().startswith('pa-') and 'vm' not in model.lower()
    impact = 'possible RCE on PA-Series hardware' if pa_series else 'documented DoS impact on non-PA platforms'

    if dns_proxy_lines and iface_attach:
        print(f'VULNERABLE: version {version} is affected, DNS Proxy is configured with interface attachment, model={model}, impact={impact}, fixed_version={fixed}')
        sys.exit(1)

    if dns_proxy_lines and not iface_attach:
        print(f'UNKNOWN: version {version} is affected and DNS Proxy is configured, but interface attachment was not conclusively parsed; model={model}, fixed_version={fixed}')
        sys.exit(3)

    if public_dns:
        print(f'UNKNOWN: version {version} is affected and management DNS uses public resolver IP(s) {public_dns}; advisory exposure depends on whether that upstream DNS is compromised/untrusted; fixed_version={fixed}')
        sys.exit(3)

    print(f'UNKNOWN: version {version} is affected but the script did not find clear DNS Proxy attachment or risky public DNS settings in the running config; manual review still required; model={model}, fixed_version={fixed}')
    sys.exit(3)

if __name__ == '__main__':
    main()