Multiple Virtual Private Network (VPN) applications store the authentication and/or session cookies insecurely in memory and/or log files.
|Virtual Private Networks (VPNs) are used to create a secure connection with another network over the internet. Multiple VPN applications store the authentication and/or session cookies insecurely in memory and/or log files.
CWE-311: Missing Encryption of Sensitive Data
The following products and versions store the cookie insecurely in memory:
It is likely that this configuration is generic to additional VPN applications. If you believe that your organization is vulnerable, please contact CERT/CC at email@example.com with the affected products, version numbers, patch information, and self-assigned CVE.
|If an attacker has persistent access to a VPN user’s endpoint or exfiltrates the cookie using other methods, they can replay the session and bypass other authentication methods. An attacker would then have access to the same applications that the user does through their VPN session.|
|Apply an update
Palo Alto Networks GlobalProtect version 4.1.1 patches this vulnerability.
CERT/CC is unaware of any patches at the time of publishing for Cisco AnyConnect and Pulse Secure Connect Secure.