Zero-Day Vulnerability in Ivanti VPN

Clive Robinson •

January 9, 2025 7:18 PM

@ ALL,

Such failings are to be anticipated as nearly a truth of life. The explanations are many and all to typically two are,

1, Over complexity.
2, Over featured.

The primary is oft the fault of builders with an excessively developed “Code Reuse” not “safety” mentality.

The second is oft the fault of selling with an excessively developed “should have function” not “safety” mentality.

However… It may also be simply –if incorrectly– argued that those that purchase don’t have any sense of “safety” of their buying decisions.

The fact is few have the required stage of understanding and as such have higher issues to do with their time, reasonably than be taught that which has close to zero return on the funding in time, effort, and sources wanted to achieve the understanding.

The fact is even for supposed gurus the air on this are is as skinny if not thinner than the rarefied ambiance atop Mt Everest.

It’s attention-grabbing to ask folks why they use a VPN. In case you say is it for message content material safety or message site visitors safety, the reply is unlikely to be both.

Typically the foremost use of VPN’s is about the place you look like inside the perceived geo-location. That’s to get round some service filtering, the obvious being “media licencing” evasion / administration.

Thus the truth that the system has been hacked may very well not be as a lot of a priority to some as may be thought at first consideration. As a result of both the VPN sits solely outdoors of their safety perimeter, the place the principle risk for them is DoS that exists no matter the VPN. Or it sits solely inside their safety perimeter, the place one other failing akin to a fringe gadget must be exploited first.

As for the opposite techniques effected then sure this for many is extra critical. Particularly if it will probably bridge the safety perimeter.