Yeah, thanks. My OP was a touch misleading. I've posted a follow-up clarification to the best that I can with the small amount of characters that they allow on this site for some reason. 😕
PDD is a company that makes Pinduoduo and Temu. The former is the version of the store for the Chinese market, made available in Chinese app stores. The latter is for the rest of the world, available in the Google Play Store. The company that runs Pinduoduo and Temu decided to use an 0day exploit.
Did you notice that Temu dropped the bucks for *several* superbowl ads? Turns out that their Android app was utilizing an 0day exploit to achieve an advantage over their competition. Totally normal stuff going on here. arstechnica.com/information-...
Every Patch Tuesday I'm reminded that in Microsoft's world, "No thanks" means "Ask me again later".
watchTowr: Ivanti Connect Secure CVE-2024-22024 - Are We Now Part Of Ivanti? labs.watchtowr.com/are-we-now-p...
Just to clarify, when I say "on a current Ivanti VPN box", this is what comes with the VMware version of the appliance that Ivanti provides for download, which is a 2023 version of the software. There may be some upgraded packages with newer versions of the Ivanti software. YMMV.
This is just a spot check of a few execuables on the system. I didn't even look at any of the libraries. If customers knew what they were purchasing, do you think they'd go through with the purchase? Imagine a complete SBOM for *everything* on the box...
Things on a currrent Ivanti VPN box: curl 7.19.7 2009-11-04 (14 years) openssl 1.0.2n-fips 2017-12-07 (6 years) perl 5.6.1 2001-04-09 (23 years) psql 9.6.14 2019-06-20 (5 years) cabextract 0.5 2001-08-20 (22 years) ssh 5.3p1 2009-10-01 (14 years) unzip 6.00 2009-04-29 (15 years)
Imagine that somebody today discovers that a popular app exposes a 10-year-old vulnerability in a library that already has a CVE. Would the world be better off if this new discovery got a new CVE, or if the existing CVE was updated to reflect this? (Where? JSON references?) Poll: - Old CVE - New CVE