US-CERT Warns Of VPN Attack That Bypasses Browser Security

by

US-CERT Warns Of VPN Attack That Bypasses Browser Security

The US-CERT has issued an advisory on a vulnerability in SSL VPN products that breaks basic browser security features, letting an attacker bypass authentication steps and wage other Web-based attacks.

There’s no known fix for the problem, according to the advisory, but US-CERT offers several workarounds to mitigate an attack that exploits the vulnerability. The advisory affects some SSL VPNs that allow browser-based – rather than VPN client-based – access to intranets and external Web resources. This type of Web-based VPN is typically used for internal Webmail server access, file shares, and remote desktop tools. Users connect to the VPN via their Web browser, which authenticates them to their VPN.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


%d bloggers like this: