VPN packages from Cisco, Palo Alto, F5 and Pulse may improperly secure tokens and cookies Credit: Getty Images The Department of Homeland Security has issued a warning that some VPN packages from Cisco, Palo Alto, F5 and Pulse may improperly secure tokens and cookies, allowing nefarious actors an opening to invade and take control over an end user’s system. The DHS’s Cybersecurity and Infrastructure Security Agency (CISA) warning comes on the heels of a notice from Carnegie Mellon’s CERT that multiple VPN applications store the authentication and/or session cookies insecurely in memory and/or log files. “If an attacker has persistent access to a VPN user’s endpoint or exfiltrates the cookie using other methods, they can replay the session and bypass other authentication methods,” CERT wrote. “An attacker would then have access to the same applications that the user does through their VPN session.” According to the CERT warning, the following products and versions store the cookie insecurely in log files: Palo Alto Networks GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS0 (CVE-2019-1573) Pulse Secure Connect Secure prior to 8.1R14, 8.2, 8.3R6, and 9.0R2. The following products and versions store the cookie insecurely in memory: Palo Alto Networks GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS0. Pulse Secure Connect Secure prior to 8.1R14, 8.2, 8.3R6, and 9.0R2. Cisco AnyConnect 4.7.x and prior. CERT says that Palo Alto Networks GlobalProtect version 4.1.1 patches this vulnerability. F5 said it was aware of both vulnerabilities and has issued advisories for both CVE-2013-6024and CVE-2017-6139. The severity of CVE-2013-6024 is low and F5 provided guidance to customers on how to mitigate. CVE-2017-6139 has been fixed in BIG-IP 12.1.3, 13.1.0 and 13.0.1 and customers can eliminate the vulnerability by upgrading to one of these versions. F5 has not received reports from customers of these vulnerabilities being exploited. CERT said it is unaware of any patches at the time of publishing for Cisco AnyConnect. Pulse said it was notified by CERT with regards to a vulnerability. This vulnerability affects older versions of Pulse Secure Desktop and Network Connect clients. However, Pulse Secure had already fixed this vulnerability in the latest Pulse Desktop Client and Network Connect product. Pulse issued a related Security Advisory to disclose this to the public – Security Advisory – SA44114. CERT credited the National Defense ISAC Remote Access Working Group for reporting the vulnerability. Related content news Singapore government pushes energy-efficient data center plan The city state is looking at greener energy sources and wants to make every aspect of data center energy consumption, from cooling to coding, more efficient. By John Leyden May 31, 2024 4 mins Energy Efficiency Data Center Design Data Center Management news Everyone but Nvidia joins forces for new AI interconnect Hyperscalers and chip makers, including AMD, Broadcom, Cisco, Google, HPE, Intel and Microsoft, are partnering to develop a high-speed chip interconnect to rival Nvidia’s NVLink technology. By Andy Patrizio May 30, 2024 4 mins CPUs and Processors Data Center news AT&T taps Cisco fixed 5G wireless gateways for WAN service Cisco Meraki devices are also part of fixed 5G wireless services from T-Mobile and Verizon. By Michael Cooney May 30, 2024 3 mins 5G Wireless Security WAN news Alibaba Cloud is betting on emerging markets with massive price cuts The strategy to lower prices may not only help Alibaba undercut competition from larger hyperscalers in emerging markets but also have a more positive effect on its image as a Chinese provider, experts say. By Anirban Ghoshal May 30, 2024 6 mins Cloud Computing PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe