Notre sélection d'alertes et avis SSI.
Sources : US Cert, Cert EU, Cert FR, Cnil, VulDB.

jeudi 23 avril 2020

Pulse Connect Secure Severe Vulnerabilities (CERT-EU Security Advisory 2020-023)

On April 6, 2020, three issues were discovered in Host Checker policy enforcement on Pulse Secure Pulse Connect Secure (PCS). These vulnerabilities were encoded as CVE-2020-11580 (No certificate Validation), CVE-2020-11581 (Command Injection), CVE-2020-11582 (DNS Rebindig). These vulnerabilities could allow a man-in-the-middle (MITM) attacker to perform a remote code execution (RCE) attack. CERT-EU is not aware of any malicious exploitation for those vulnerabilities, but we have to take into consideration that the file on which these vulnerabilities are built ("tncc.jar") is not obfuscated in any way and the original source code can be obtained with almost any Java decompiler and customized in a malicious manner.

Lien vers l'article source

Auteur: Cert EU

Catégories: CertEUNombre de vues: 169


Événements SSI