Jump to content

Ivanti Pulse Secure was using decade-old Linux and outdated libraries — no wonder it was such a popular target for hackers


Recommended Posts

rssImage-9c8879aa5292b66b7b48057e50d33934.jpeg

Knowing which operating system, as well as libraries, Ivanti Pulse Secure used, it is no wonder hackers keep finding new zero-day vulnerabilities to exploit.

That's the conclusion of security analysts from Eclypsium, who analyzed firmware version 9.1.18.2-24467.1 and concluded that the operating system used was CentOS 6.4.

"Pulse Secure runs an 11-year-old version of Linux which hasn't been supported since November 2020," it said in the follow-up report.

Thousands of vulnerable endpoints

What’s more, Eclypsium discovered multiple libraries which, among themselves, are vulnerable to 973 flaws. Of those, 111 have publicly known exploits. "This is a perfect example as to why visibility into digital supply chains is important and why enterprise customers are increasingly demanding SBOMs from their vendors,” the researchers concluded.

There’s more - researchers found more than 1,200 problems in 76 shell scripts, more than 5,000 flaws in 5,392 Python files, and 133 outdated certificates.

Finally, Eclypsium also discovered a problem in the logic of the Integrity Checker Tool (ITC), which the company recommends as the go-to tool when looking for indicators of compromise, it said. As the tool excludes more than a dozen important directories, hackers could easily pass the integrity check and remain on the endpoint.

A separate report by BleepingComputer claims thousands of Ivanti’s Connect Secure and Policy Secure endpoints remain vulnerable to the flaws found earlier this year. Despite the patches already rolled out, hackers are exploiting outdated endpoints for CVE-2024-22024, CVE-2023-46805, CVE-2024-21887, CVE-2024-21893, and CVE-2024-21888. 

Cybersecurity researcher Yutaka Sejiyam scanned the internet through Shodan and found, at the time of going to press, that there were more than 13,600 Ivanti servers still vulnerable to the abovementioned flaws.

Some of the vulnerabilities, the media reported earlier, were abused by state-sponsored threat actors and used in espionage campaigns.

Via The Hacker News

More from TechRadar Pro

View the full article

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...