BOOK AN APPOINTMENT WITH AN IT SPECIALIST TODAY

10 Jan 2020

AA20-010A: Continued Exploitation of Pulse Secure VPN Vulnerability

Original release date: January 10, 2020 | Last revised: April 15, 2020

Summary

Unpatched Pulse Secure VPN servers continue to be an attractive target for malicious actors. Affected organizations that have not applied the software patch to fix an arbitrary file reading vulnerability, known as CVE-2019-11510, can become compromised in an attack. [1]

Although Pulse Secure [2] disclosed the vulnerability and provided software patches for the various affected products in April 2019, the Cybersecurity and Infrastructure Security Agency (CISA) continues to observe wide exploitation of CVE-2019-11510. [3] [4] [5]

CISA expects to see continued attacks exploiting unpatched Pulse Secure VPN environments and strongly urges users and administrators to upgrade to the corresponding fixes. [6]

Timelines of Specific Events

  • April 24, 2019 – Pulse Secure releases initial advisory and software updates addressing multiple vulnerabilities.
  • May 28, 2019 – Large commercial vendors get reports of vulnerable VPN through HackerOne.
  • July 31, 2019 – Full use of exploit demonstrated using the admin session hash to get complete shell.
  • August 8, 2019 – Meh Chang and Orange Tsai demonstrate the VPN issues across multiple vendors (Pulse Secure) with detailed attack on active VPN exploitation.
  • August 24, 2019 – Bad Packets identifies over 14,500 vulnerable VPN servers globally still unpatched and in need of an upgrade.
  • October 7, 2019 – The National Security Agency (NSA) produces a Cybersecurity Advisory on Pulse Secure and other VPN products being targeted actively by advanced persistent threat actors.
  • October 16, 2019 – The CERT Coordination Center (CERT/CC) releases Vulnerability Note VU#927237: Pulse Secure VPN contains multiple vulnerabilities.
  • January 2020 – Media reports cybercriminals now targeting unpatched Pulse Secure VPN servers to install REvil (Sodinokibi) ransomware.   

Technical Details

Impact

A remote, unauthenticated attacker may be able to compromise a vulnerable VPN server. The attacker may be able to gain access to all active users and their plain-text credentials. It may also be possible for the attacker to execute arbitrary commands on each VPN client as it successfully connects to the VPN server.

Affected versions:

  • Pulse Connect Secure 9.0R1 – 9.0R3.3
  • Pulse Connect Secure 8.3R1 – 8.3R7
  • Pulse Connect Secure 8.2R1 – 8.2R12
  • Pulse Connect Secure 8.1R1 – 8.1R15
  • Pulse Policy Secure 9.0R1 – 9.0R3.1
  • Pulse Policy Secure 5.4R1 – 5.4R7
  • Pulse Policy Secure 5.3R1 – 5.3R12
  • Pulse Policy Secure 5.2R1 – 5.2R12
  • Pulse Policy Secure 5.1R1 – 5.1R15

Mitigations

This vulnerability has no viable workarounds except for applying the patches provided by the vendor and performing required system updates.

CISA strongly urges users and administrators to upgrade to the corresponding fixes. [7]

References

Revisions

  • January 10, 2020: Initial Version
  • April 15, 2020: Revised to correct type of vulnerability

This product is provided subject to this Notification and this Privacy & Use policy.

More Like This

A Quintessential Guide to Windows 11 Tips and News

A Quintessential Guide to Windows 11 Tips and News Windows 11 introduces a wide selection of interesting new features capable of transforming the user experience. In addition, the operating system comes with a streamlined design, Android apps integration capabilities, a built-in Microsoft Teams conferencing application, and other notable features. Examples of features that you can …

A Quintessential Guide to Windows 11 Tips and News Read More »

Read More

AA21-291A: BlackMatter Ransomware

Original release date: October 18, 2021 Summary Actions You Can Take Now to Protect Against BlackMatter Ransomware • Implement and enforce backup and restoration policies and procedures. • Use strong, unique passwords. • Use multi-factor authentication. • Implement network segmentation and traversal monitoring. Note: this advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) …

AA21-291A: BlackMatter Ransomware Read More »

Read More

Outages Result of DDoS Attack” Confirms Bandwidth CEO

Outages Result of DDoS Attack” Confirms Bandwidth CEO David Morken, CEO of Bandwidth.com, has confirmed that a DDoS attack was responsible for recent outages reported on the site on September 27th. Citing that “a number of critical communications service providers have been targeted by a rolling DDoS attack” in a recent statement, Morken also apologized …

Outages Result of DDoS Attack” Confirms Bandwidth CEO Read More »

Read More

AA21-287A: Ongoing Cyber Threats to U.S. Water and Wastewater Systems

Original release date: October 14, 2021 Summary Immediate Actions WWS Facilities Can Take Now to Protect Against Malicious Cyber Activity • Do not click on suspicious links. • If you use RDP, secure and monitor it. • Use strong passwords. • Use multi-factor authentication. Note: This Alert uses the MITRE Adversarial Tactics, Techniques, and Common …

AA21-287A: Ongoing Cyber Threats to U.S. Water and Wastewater Systems Read More »

Read More

What You Need To Know About The Facebook Outage

What You Need To Know About The Facebook Outage Facebook and its associated services experienced a six-hour outage on Monday. Facebook, Instagram, WhatsApp, and Oculus suffered a major outage over the course of Monday, Oct. 4. Beginning just before noon EST, the outage lasted six hours, preventing users from accessing their social media profiles, messaging …

What You Need To Know About The Facebook Outage Read More »

Read More

Are You Ready For Windows 11 Official Release on October 5, 2021?

Are You Ready For Windows 11 Official Release on October 5, 2021? As the official release date for the free upgrade to Windows 11 nears, it is time to prepare for the new Windows experience. You can upgrade to the new operating system, depending on the eligibility of your Windows 7 or 10 PC. Microsoft …

Are You Ready For Windows 11 Official Release on October 5, 2021? Read More »

Read More