PT-2019-12365 · Pulse · Pulse Connect Secure+1

CVE-2019-11542 · Publicado 2019-04-26 · Atualizado 2024-02-27

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AC:H/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions 9.0RX before 9.0R3.4 Pulse Connect Secure versions 8.3RX before 8.3R7.1 Pulse Connect Secure versions 8.2RX before 8.2R12.1 Pulse Connect Secure versions 8.1RX before 8.1R15.1 Pulse Policy Secure versions 9.0RX before 9.0R3.2 Pulse Policy Secure versions 5.4RX before 5.4R7.1 Pulse Policy Secure versions 5.3RX before 5.3R12.1 Pulse Policy Secure versions 5.2RX before 5.2R12.1 Pulse Policy Secure versions 5.1RX before 5.1R15.1

Description An authenticated attacker, via the admin web interface, can send a specially crafted message resulting in a stack buffer overflow.

Recommendations For Pulse Connect Secure version 9.0RX, update to version 9.0R3.4 or later. For Pulse Connect Secure version 8.3RX, update to version 8.3R7.1 or later. For Pulse Connect Secure version 8.2RX, update to version 8.2R12.1 or later. For Pulse Connect Secure version 8.1RX, update to version 8.1R15.1 or later. For Pulse Policy Secure version 9.0RX, update to version 9.0R3.2 or later. For Pulse Policy Secure version 5.4RX, update to version 5.4R7.1 or later. For Pulse Policy Secure version 5.3RX, update to version 5.3R12.1 or later. For Pulse Policy Secure version 5.2RX, update to version 5.2R12.1 or later. For Pulse Policy Secure version 5.1RX, update to version 5.1R15.1 or later.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2019-11542

Produtos afetados

Pulse Connect Secure

Pulse Policy Secure

Referências · 10

• 🔥 https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf · Exploit
• 🔥 https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study · Exploit
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 · Nota
• https://kb.cert.org/vuls/id/927237 · Nota
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 · Aviso do Fabricante
• http://securityfocus.com/bid/108073 · Nota
• https://osv.dev/vulnerability/CVE-2019-11542 · Aviso do Fabricante
• https://t.me/cvenotify/72492 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-11542 · Nota de Segurança
• https://t.me/cvenotify/46789 · Publicação no Telegram