Zero-Day Vulnerability in Ivanti VPN

Clive Robinson •

January 9, 2025 7:18 PM

@ ALL,

Such failings are to be anticipated as virtually a truth of life. The explanations are many and all to typically two are,

1, Over complexity.
2, Over featured.

The primary is oft the fault of builders with a very developed “Code Reuse” not “safety” mentality.

The second is oft the fault of selling with a very developed “should have function” not “safety” mentality.

However… It will also be simply –if incorrectly– argued that those that purchase don’t have any sense of “safety” of their buying decisions.

The truth is few have the required stage of understanding and as such have higher issues to do with their time, quite than study that which has close to zero return on the funding in time, effort, and sources wanted to achieve the understanding.

The truth is even for supposed gurus the air on this are is as skinny if not thinner than the rarefied environment atop Mt Everest.

It’s fascinating to ask folks why they use a VPN. For those who say is it for message content material safety or message visitors safety, the reply is unlikely to be both.

Typically the foremost use of VPN’s is about the place you seem like throughout the perceived geo-location. That’s to get round some service filtering, the obvious being “media licencing” evasion / administration.

Thus the truth that the system has been hacked may very well not be as a lot of a priority to some as could be thought at first consideration. As a result of both the VPN sits completely outdoors of their safety perimeter, the place the principle risk for them is DoS that exists regardless of the VPN. Or it sits completely inside their safety perimeter, the place one other failing resembling a fringe gadget must be exploited first.

As for the opposite programs effected then sure this for many is extra severe. Particularly if it may possibly bridge the safety perimeter.