PT-2019-12365 · Pulse · Pulse Connect Secure+1

Published 2019-04-26 · Updated 2024-02-27 · CVE-2019-11542

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AC:H/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions 9.0RX before 9.0R3.4 Pulse Connect Secure versions 8.3RX before 8.3R7.1 Pulse Connect Secure versions 8.2RX before 8.2R12.1 Pulse Connect Secure versions 8.1RX before 8.1R15.1 Pulse Policy Secure versions 9.0RX before 9.0R3.2 Pulse Policy Secure versions 5.4RX before 5.4R7.1 Pulse Policy Secure versions 5.3RX before 5.3R12.1 Pulse Policy Secure versions 5.2RX before 5.2R12.1 Pulse Policy Secure versions 5.1RX before 5.1R15.1

Description An authenticated attacker, via the admin web interface, can send a specially crafted message resulting in a stack buffer overflow.

Recommendations For Pulse Connect Secure version 9.0RX, update to version 9.0R3.4 or later. For Pulse Connect Secure version 8.3RX, update to version 8.3R7.1 or later. For Pulse Connect Secure version 8.2RX, update to version 8.2R12.1 or later. For Pulse Connect Secure version 8.1RX, update to version 8.1R15.1 or later. For Pulse Policy Secure version 9.0RX, update to version 9.0R3.2 or later. For Pulse Policy Secure version 5.4RX, update to version 5.4R7.1 or later. For Pulse Policy Secure version 5.3RX, update to version 5.3R12.1 or later. For Pulse Policy Secure version 5.2RX, update to version 5.2R12.1 or later. For Pulse Policy Secure version 5.1RX, update to version 5.1R15.1 or later.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-11542

Affected Products

Pulse Connect Secure

Pulse Policy Secure

References · 10

• 🔥 https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf · Exploit
• 🔥 https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study · Exploit
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11542 · Security Note
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 · Note
• https://kb.cert.org/vuls/id/927237 · Note
• http://securityfocus.com/bid/108073 · Note
• https://t.me/cvenotify/72492 · Telegram Post
• https://t.me/cvenotify/46789 · Telegram Post