Patch Issued for Critical Vulnerability in Pulse Connect Secure VPNs -- Redmondmag.com

Patch Issued for Critical Vulnerability in Pulse Connect Secure VPNs

By Kurt Mackie
05/03/2021

Ivanti Pulse Secure announced a patch on Monday for a "Critical"-rated vulnerability (CVE-2021-22893) in its Pulse Connect Secure VPN appliances.

The release follows up on Pulse Secure's pledge to deliver a fix for the vulnerability in "early May." It addresses a remote code execution vulnerability on the Pulse Connect Secure gateway that was rated "10" on the Common Vulnerability Scoring System scale.

Pulse Secure had issued Security Advisory SA44784 regarding the vulnerability back on April 20. At that time, the company indicated it was providing "mitigations directly to the limited number of impacted customers," prior to the arrival of a patch.

The company credited collaborations with the U.S. Cybersecurity and Infrastructure Security Agency, the Mandiant/FireEye security solutions firm and Stroz Friedberg for getting the patch out "in such short order." The Cybersecurity and Infrastructure Security Agency also noted the patch's release in this Monday advisory.

Organizations using the Pulse Connect Secure gateway should "move quickly to apply the update to ensure they are protected," Pulse Secure's Monday announcement urged. Also recommended was the use of the Pulse Security Integrity Checker Tool, which can help Pulse Secure customers "identify malicious activity on their systems."

CVE-2021-22893 is just one of four prominent vulnerabilities found in the Pulse Connect Secure gateway over the past year or so. This latest one was being exploited by advanced persistent threat groups to install Webshells, according to analysis by Mandiant/FireEye.

In response, Pulse Secure is planning to tighten its application development standards, according to CSO Phil Richards.

"Companywide we are making significant investments to enhance our overall cyber security posture, including a more broad implementation of secure application development standards," Richards indicated in the announcement.

VPN maker Pulse Secure was acquired last year by Ivanti, a producer of security and IT management solutions.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Using Configuration Files to Control PowerShell Scripts, Part 2: Building Blocks

Learn how to use PowerShell's GUI capabilities to dynamically create configuration files that enhance script flexibility and usability.
U.S. House Leaders Unveil Bipartisan Strategy for AI Governance and Innovation

On Tuesday, U.S. House Speaker Mike Johnson and Democratic Leader Hakeem Jeffries received the final report from the bipartisan House Task Force on Artificial Intelligence, which outlines essential principles and recommendations to bolster American leadership in AI.
Using Configuration Files to Control PowerShell Scripts, Part 1: The Basics

Learn how to use JSON configuration files to make PowerShell scripts more dynamic, flexible and user-friendly.
Exchange Online Receiving Enhanced Message Trace

Microsoft has announced the public preview of its enhanced Message Trace feature in the Exchange admin center (EAC) for Exchange Online.
Major Microsoft Multifactor Authentication Vulnerability Revealed

A vulnerability in Microsoft’s multifactor authentication (MFA) system has been uncovered by cybersecurity firm Oasis Security, allowing attackers to bypass security measures and access sensitive data across services including Outlook, OneDrive, Teams and Azure.