Now on Demand: CISO Forum Virtual Summit - All Sessions Available to Watch Instantly
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Pulse Secure Ships Belated Fix for VPN Zero-Day

Embattled VPN technology vendor Pulse Secure on Monday updated an “out-of-cycle” advisory with patches for four major security vulnerabilities, including belated cover for an issue that’s already been exploited by advanced threat actors.

Embattled VPN technology vendor Pulse Secure on Monday updated an “out-of-cycle” advisory with patches for four major security vulnerabilities, including belated cover for an issue that’s already been exploited by advanced threat actors.

The most serious of the four issues — CVE-2021-22893 — covers multiple memory corruption flaws in the Pulse Connect Secure product that could allow remote, unauthenticated code execution attacks via license server web services.

When Pulse Secure released its initial advisory for the bug on April 20, FireEye reported seeing this and three other Pulse Secure VPN appliance vulnerabilities being exploited as an initial access vector by at least two sophisticated threat actors. The CVE-2021-22893 flaw was the only zero-day — the other three Pulse Secure vulnerabilities believed to have been used in these attacks (CVE-2019-11510, CVE-2020-8243 and CVE-2020-8260) were patched in 2019 and 2020. 

The attacks described at the time by FireEye were attributed to two threat groups: UNC2630, which targeted defense industrial base companies in the United States and which has been linked to the Chinese government and a group tracked as APT5; and UNC2717, which targeted global government agencies but which hasn’t been linked to any known threat group. 

FireEye has identified several new malware families associated with the exploitation of Pulse Secure VPN appliances. This malware includes trojans, backdoors and web shells tracked as SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, PULSECHECK, HARDPULSE, QUIETPULSE, and PULSEJUMP.

The new Pulse Secure advisory also provides cover for three additional issues that expose users to remote code execution and command injection attacks.  Two of the three vulnerabilities — CVE-2021-22894 and CVE-2021-22899 — carry CVSS scores of 9.9 and are rated “critical.” However, exploitation, which involves specially crafted meeting rooms and Windows file resource profiles, requires authentication. 

“We recommend that customers move quickly to apply the update to ensure they are protected,” said Pulse Secure chief security officer Phil Richards.

Richards also recommended the use of the company’s Pulse Security Integrity Checker Tool to help customers identify malicious activity on their systems, and continue to apply and follow recommended guidance for all available security patches.

Advertisement. Scroll to continue reading.

“Companywide we are making significant investments to enhance our overall cyber security posture, including a more broad implementation of secure application development standards,” he added.

It’s not uncommon for threat actors to target vulnerabilities in Pulse Secure products. Over the past few years, flaws in Pulse Secure VPN appliances have been exploited by both state-sponsored threat actors and profit-driven cybercrime groups.

* Additional reporting by Eduard Kovaks.

Related: CISA: Pulse Secure VPN Vulnerability Still Widely Exploited

Related: ‘Black Kingdom’ Ransomware  Target Pulse Secure VPNs

Related: NSA: Russian Hackers Exploiting VPN Vulnerabilities 

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join SecurityWeek and Hitachi Vantara for this this webinar to gain valuable insights and actionable steps to enhance your organization's data security and resilience.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

Secure enterprise browser provider Menlo Security has appointed Bill Robbins as President.

Erik Rolf has joined Booz Allen Hamilton as the Business Information Security Officer (BISO) of Commercial Sector.

Gant Redmon has joined Trustle as its new Chief Executive Officer and Board Director.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.