Security News > 2020 > January > Patch or Perish: VPN Servers Hit by Ransomware Attackers

On Saturday, Troy Mursch of Chicago-based threat intelligence firm Bad Packets reported that his internet scans have identified 3,825 Pulse Secure VPN servers that remain at risk because they have not been updated with a patch to fix a critical vulnerability, designated CVE-2019-1150.

The patch for Pulse Secure VPN servers - as with critical patches for VPN servers built by Fortinet and Palo Alto that have also required updates to fix serious flaws since last year - has been available for months.

There are organizations that have yet to apply this patch. We continue to request customers to apply the April patch fix to their VPN systems - this server-side patch does not require updating the client."

Patching of Fortinet servers is also incomplete, with many still remaining vulnerable to CVE-2018-13379 - designated FG-IR-18-384 by the vendor - which enables attackers to easily steal plaintext passwords and usernames from servers.

Bad Packets' Mursch tells ComputerWeekly that Travelex had seven Pulse Secure VPN servers - in Australia, the Netherlands, the U.K. and the U.S. - that it failed to patch against CVE-2019-11510 until November 2019, although he said it had been directly warned before that.

News URL

https://www.inforisktoday.com/patch-or-perish-vpn-servers-hit-by-ransomware-attackers-a-13583