<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div dir="ltr"><span></span></div>
<div dir="ltr">
<div dir="ltr"><span></span></div>
<div dir="ltr"><br>
<br>
<div dir="ltr">Sent from an iPad PRO</div>
<div dir="ltr"><br>
Begin forwarded message:<br>
<br>
</div>
<blockquote type="cite">
<div dir="ltr"><b>From:</b> SANS NewsBites <<a href="mailto:newsbites@email.sans.org">newsbites@email.sans.org</a>><br>
<b>Date:</b> 27 July 2019 at 4:34:01 am AEST<br>
<br>
<b>Subject:</b> <b>SANS NewsBites Vol. 21 Num. 058 : Ransomware Hits Electric Power Provider and 3 Louisiana School Districts; VPN Flaws Affect Widely Used Products</b><br>
<b>Reply-To:</b> SANS Institute <<a href="mailto:reply-fec311717d610c7c-104_HTML-101058480-7230382-964@email.sans.org">reply-fec311717d610c7c-104_HTML-101058480-7230382-964@email.sans.org</a>><br>
<br>
</div>
</blockquote>
<blockquote type="cite">
<div dir="ltr">
<div style="font-family: Arial; font-size: 13px;"><font color="#005880" face="Arial"><span style="font-size: 18px;"><b>VPN Flaws Affect Widely Used Products</b></span></font></div>
<div style="font-family: Arial; font-size: 13px;"><font face="Arial" style="font-size: 11px;"><b>(July 23, 2019)</b><br>
</font></div>
<div style="font-family: Arial; font-size: 13px;">Critical flaws in popular virtual private networks (VPNs) could be exploited to gain access to corporate networks and steal data. The flaws are easily remotely exploitable; they affect VPNs from Palo Alto Networks,
Pulse Secure, and Fortinet. All three have released advisories and updates to address the issues. Devcore researchers plan to discuss their findings about the flaws at the Black Hat security conference next month.<br>
</div>
<div style="font-family: Arial; font-size: 13px;"><b>Editor's Note</b><br>
<br>
<font color="878b8f">[<a alias="John Pescatore" conversion="false" data-linkto="https://" href="https://www.sans.org/newsletters/newsbites/editorial-board#john-pescatore" style="color:#878b8f;text-decoration:underline;" title="John Pescatore">Pescatore</a>]</font><br>
This is a good reminder about the importance of a complete and accurate software inventory. Patches for this vulnerability have been out for a while but often tools or components like VPN software are overlooked.<br>
<br>
<font color="878b8f">[<a alias="Lee Neely" conversion="false" data-linkto="https://" href="https://www.sans.org/newsletters/newsbites/editorial-board#lee-neely" style="color:#878B8F;text-decoration:underline;" title="Lee Neely">Neely</a>]</font><br>
While the patches have been out for a bit, scans found many devices online still running the vulnerable code. Make sure that your boundary protections, including VPN, Firewalls, IDS/IPS are in your maintenance schedule with priority for updates. You may need
to acquire non-production units to satisfy regression testing requirements.</div>
<div><br>
<b>Read more in:<br>
<font color="117db6">-</font> <a alias="techcrunch.com/2019/07/23/corporate-vpn-flaws-risk/" conversion="false" data-linkto="http://" href="http://techcrunch.com/2019/07/23/corporate-vpn-flaws-risk/" style="text-decoration:underline;" title="techcrunch.com/2019/07/23/corporate-vpn-flaws-risk/">techcrunch.com</a></b>:
Flaws in widely used corporate VPNs put company secrets at risk<br>
<b><font color="117db6">-</font> <a alias="www.zdnet.com/article/uber-hit-by-critical-vulnerability-in-palo-alto-vpn-solution/" conversion="false" data-linkto="http://" href="http://www.zdnet.com/article/uber-hit-by-critical-vulnerability-in-palo-alto-vpn-solution/" style="text-decoration:underline;" title="www.zdnet.com/article/uber-hit-by-critical-vulnerability-in-palo-alto-vpn-solution/">www.zdnet.com</a></b>:
Critical flaw in Palo Alto VPN solution impacts Uber, other enterprises may be at risk<br>
<b><font color="117db6">-</font> <a alias="nvd.nist.gov/vuln/detail/CVE-2019-11510" conversion="false" data-linkto="http://" href="http://nvd.nist.gov/vuln/detail/CVE-2019-11510" style="text-decoration:underline;" title="nvd.nist.gov/vuln/detail/CVE-2019-11510">nvd.nist.gov</a></b>:
CVE-2019-11510 Detail<br>
<b><font color="117db6">-</font> <a alias="securityadvisories.paloaltonetworks.com/Home/Detail/158" conversion="false" data-linkto="http://" href="http://securityadvisories.paloaltonetworks.com/Home/Detail/158" style="text-decoration:underline;" title="securityadvisories.paloaltonetworks.com/Home/Detail/158">securityadvisories.paloaltonetworks.com</a></b>:
Advisory (CVE-2019-1579)<br>
<b><font color="117db6">-</font> <a alias="fortiguard.com/psirt/FG-IR-18-384" conversion="false" data-linkto="http://" href="http://fortiguard.com/psirt/FG-IR-18-384" style="text-decoration:underline;" title="fortiguard.com/psirt/FG-IR-18-384">fortiguard.com</a></b>:
FortiOS system file leak through SSL VPN via specially crafted HTTP resource requests<br>
<b><font color="117db6">-</font> <a alias="kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101" conversion="false" data-linkto="http://" href="http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101" style="text-decoration:underline;" title="kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101">kb.pulsesecure.net</a></b>:
SA44101 - 2019-04: Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RX</div>
</div>
</blockquote>
</div>
</div>
IMPORTANT - This email and any attachments may be confidential. If received in error, please contact us and delete all copies. Before opening or using attachments check them for viruses and defects. Regardless of any loss, damage or consequence, whether caused
by the negligence of the sender or not, resulting directly or indirectly from the use of any attached files our liability is limited to resupplying any affected attachments. Any representations or opinions expressed are those of the individual sender, and
not necessarily those of the Department of Education and Training.
</body>
</html>