On April 6, 2020, three issues were discovered in Host Checker policy enforcement on Pulse Secure Pulse Connect Secure (PCS). These vulnerabilities were encoded as CVE-2020-11580 (No certificate Validation), CVE-2020-11581 (Command Injection), CVE-2020-11582 (DNS Rebindig). These vulnerabilities could allow a man-in-the-middle (MITM) attacker to perform a remote code execution (RCE) attack. CERT-EU is not aware of any malicious exploitation for those vulnerabilities, but we have to take into consideration that the file on which these vulnerabilities are built ("tncc.jar") is not obfuscated in any way and the original source code can be obtained with almost any Java decompiler and customized in a malicious manner.

Lien vers l'article source