Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Pulse Secure Ships Belated Fix for VPN Zero-Day

Embattled VPN technology vendor Pulse Secure on Monday updated an “out-of-cycle” advisory with patches for four major security vulnerabilities, including belated cover for an issue that’s already been exploited by advanced threat actors.

Embattled VPN technology vendor Pulse Secure on Monday updated an “out-of-cycle” advisory with patches for four major security vulnerabilities, including belated cover for an issue that’s already been exploited by advanced threat actors.

The most serious of the four issues — CVE-2021-22893 — covers multiple memory corruption flaws in the Pulse Connect Secure product that could allow remote, unauthenticated code execution attacks via license server web services.

When Pulse Secure released its initial advisory for the bug on April 20, FireEye reported seeing this and three other Pulse Secure VPN appliance vulnerabilities being exploited as an initial access vector by at least two sophisticated threat actors. The CVE-2021-22893 flaw was the only zero-day — the other three Pulse Secure vulnerabilities believed to have been used in these attacks (CVE-2019-11510, CVE-2020-8243 and CVE-2020-8260) were patched in 2019 and 2020. 

The attacks described at the time by FireEye were attributed to two threat groups: UNC2630, which targeted defense industrial base companies in the United States and which has been linked to the Chinese government and a group tracked as APT5; and UNC2717, which targeted global government agencies but which hasn’t been linked to any known threat group. 

FireEye has identified several new malware families associated with the exploitation of Pulse Secure VPN appliances. This malware includes trojans, backdoors and web shells tracked as SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, PULSECHECK, HARDPULSE, QUIETPULSE, and PULSEJUMP.

The new Pulse Secure advisory also provides cover for three additional issues that expose users to remote code execution and command injection attacks.  Two of the three vulnerabilities — CVE-2021-22894 and CVE-2021-22899 — carry CVSS scores of 9.9 and are rated “critical.” However, exploitation, which involves specially crafted meeting rooms and Windows file resource profiles, requires authentication. 

“We recommend that customers move quickly to apply the update to ensure they are protected,” said Pulse Secure chief security officer Phil Richards.

Richards also recommended the use of the company’s Pulse Security Integrity Checker Tool to help customers identify malicious activity on their systems, and continue to apply and follow recommended guidance for all available security patches.

“Companywide we are making significant investments to enhance our overall cyber security posture, including a more broad implementation of secure application development standards,” he added.

It’s not uncommon for threat actors to target vulnerabilities in Pulse Secure products. Over the past few years, flaws in Pulse Secure VPN appliances have been exploited by both state-sponsored threat actors and profit-driven cybercrime groups.

* Additional reporting by Eduard Kovaks.

Related: CISA: Pulse Secure VPN Vulnerability Still Widely Exploited

Related: ‘Black Kingdom’ Ransomware  Target Pulse Secure VPNs

Related: NSA: Russian Hackers Exploiting VPN Vulnerabilities 

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.