Patch Issued for Critical Vulnerability in Pulse Connect Secure VPNs -- Redmondmag.com

Patch Issued for Critical Vulnerability in Pulse Connect Secure VPNs

By Kurt Mackie
05/03/2021

Ivanti Pulse Secure announced a patch on Monday for a "Critical"-rated vulnerability (CVE-2021-22893) in its Pulse Connect Secure VPN appliances.

The release follows up on Pulse Secure's pledge to deliver a fix for the vulnerability in "early May." It addresses a remote code execution vulnerability on the Pulse Connect Secure gateway that was rated "10" on the Common Vulnerability Scoring System scale.

Pulse Secure had issued Security Advisory SA44784 regarding the vulnerability back on April 20. At that time, the company indicated it was providing "mitigations directly to the limited number of impacted customers," prior to the arrival of a patch.

The company credited collaborations with the U.S. Cybersecurity and Infrastructure Security Agency, the Mandiant/FireEye security solutions firm and Stroz Friedberg for getting the patch out "in such short order." The Cybersecurity and Infrastructure Security Agency also noted the patch's release in this Monday advisory.

Organizations using the Pulse Connect Secure gateway should "move quickly to apply the update to ensure they are protected," Pulse Secure's Monday announcement urged. Also recommended was the use of the Pulse Security Integrity Checker Tool, which can help Pulse Secure customers "identify malicious activity on their systems."

CVE-2021-22893 is just one of four prominent vulnerabilities found in the Pulse Connect Secure gateway over the past year or so. This latest one was being exploited by advanced persistent threat groups to install Webshells, according to analysis by Mandiant/FireEye.

In response, Pulse Secure is planning to tighten its application development standards, according to CSO Phil Richards.

"Companywide we are making significant investments to enhance our overall cyber security posture, including a more broad implementation of secure application development standards," Richards indicated in the announcement.

VPN maker Pulse Secure was acquired last year by Ivanti, a producer of security and IT management solutions.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.