In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, an authenticated attacker (via the admin web interface) can send a specially crafted message resulting in a stack buffer overflow.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/108073 | Broken Link Third Party Advisory VDB Entry |
https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ | Exploit Third Party Advisory |
https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf | Exploit Third Party Advisory |
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 | Vendor Advisory |
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 | Third Party Advisory |
https://www.kb.cert.org/vuls/id/927237 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
|
History
27 Feb 2024, 21:04
Type | Values Removed | Values Added |
---|---|---|
First Time |
Ivanti connect Secure
Ivanti |
|
CPE | cpe:2.3:a:pulsesecure:pulse_connect_secure:8.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_connect_secure:8.2:*:*:*:*:*:*:* |
cpe:2.3:a:ivanti:connect_secure:8.2:*:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:*:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:*:*:*:*:*:*:* |
Information
Published : 2019-04-26 02:29
Updated : 2024-02-28 17:08
NVD link : CVE-2019-11542
Mitre link : CVE-2019-11542
CVE.ORG link : CVE-2019-11542
JSON object : View
Products Affected
pulsesecure
- pulse_connect_secure
- pulse_policy_secure
ivanti
- connect_secure
CWE
CWE-787
Out-of-bounds Write