vpn vulnerabilities Archives

Researchers Unearth New VPN Vulnerabilities Over the past few days, details about security vulnerabilities relating to virtual private network (VPN) have been disclosed by security researchers. Immersive Labs researcher and content engineer Alex Seymour recently disclosed that he found two security vulnerabilities, one referred to as CVE-2019-17387 and the other security vulnerability referred to as CVE-2019-17388, in Aviatrix VPN, an enterprise VPN used by organizations such as the National Aeronautics and Space Administration (NASA). CVE-2019-17387, in particular, allows an attacker to gain elevated privileges through arbitrary code execution on these operating systems: Windows, Linux and macOS. While Aviatrix uses certificates to validate legitimate VPN users, preventing supposedly unauthorized access, Immersive Labs said that a bit of digging reveals that relevant private key and certificates can be retrieved inside the file…

Patch Now: Ongoing Exploitation of Known Vulnerabilities in Several VPN Products Reported UK’s National Cyber Security Centre (NCSC) has recently issued an alert directed to both UK and international organizations about the ongoing exploitation in a number of VPN products from Pulse Secure, Fortinet and Palo Alto. The latest security alert from the NCSC echoes an earlier security alert from the Canadian Centre for Cyber Security. According to the NCSC, the highest-impact vulnerabilities known to be exploited by malicious actors are the following: Pulse Connect Secure: CVE-2019-11510: A pre-auth arbitrary file reading vulnerability that allows an unauthenticated remote attacker to download any file they want. CVE-2019-11539: A post-auth command injection vulnerability in which Pulse Connect Secure's VPN admin web interface allows an authenticated attacker to inject…