Zero-Day Vulnerability in Ivanti VPN

Clive Robinson •

January 9, 2025 7:18 PM

@ ALL,

Such failings are to be anticipated as nearly a reality of life. The causes are many and all to usually two are,

1, Over complexity.
2, Over featured.

The first is oft the fault of builders with an excessively developed “Code Reuse” not “security” mentality.

The second is oft the fault of selling with an excessively developed “must have feature” not “security” mentality.

But… It may also be simply –if incorrectly– argued that those that purchase don’t have any sense of “security” of their buying decisions.

The actuality is few have the required stage of understanding and as such have higher issues to do with their time, fairly than study that which has close to zero return on the funding in time, effort, and assets wanted to realize the understanding.

The actuality is even for supposed gurus the air on this are is as skinny if not thinner than the rarefied environment atop Mt Everest.

It’s attention-grabbing to ask individuals why they use a VPN. If you say is it for message content material safety or message visitors safety, the reply is unlikely to be both.

Often the main use of VPN’s is about the place you seem like inside the perceived geo-location. That is to get round some service filtering, the obvious being “media licencing” evasion / administration.

Thus the truth that the system has been hacked may very well not be as a lot of a priority to some as is perhaps thought at first consideration. Because both the VPN sits totally exterior of their safety perimeter, the place the principle risk for them is DoS that exists regardless of the VPN. Or it sits totally inside their safety perimeter, the place one other failing akin to a fringe gadget must be exploited first.

As for the opposite methods effected then sure this for many is extra critical. Especially if it may bridge the safety perimeter.