January 29, 2024 at 03:06PM
Ivanti is facing delays in delivering patches for critical vulnerabilities in its Connect Secure VPN appliances, which have already been exploited. The company missed its promised timeline and now aims to release patches next week. The delays come after Chinese hackers exploited zero-day vulnerabilities, raising concerns for US government agencies and requiring temporary mitigations.
Based on the meeting notes, the key takeaways are:
– Ivanti is experiencing delays in delivering patches for critical vulnerabilities in its Connect Secure VPN appliances, which have already been exploited.
– The delays have been attributed to testing and quality issues, leading to a missed deadline for the release of patches.
– Ivanti has acknowledged the missed deadline and is now targeting the following week for the release of patches for supported versions of its products. It also warned that the timing of patch releases is subject to change.
– The patch delays come after researchers observed Chinese government-backed hacking teams exploiting two zero-day vulnerabilities in Ivanti products.
– The absence of official fixes may complicate the deadlines set by the US government’s cybersecurity agency, CISA, for federal agencies to apply available fixes.
– CISA has issued an emergency directive requiring agencies to implement Ivanti’s published mitigation immediately to prevent future exploitation and to run Ivanti’s External Integrity Checker Tool for detecting indications of compromise.
These takeaways capture the main points from the meeting notes, providing a clear summary of the key issues discussed related to Ivanti’s patch delivery delays and the impact on cybersecurity.