SA43582 - Out-of-Cycle Advisory: Virtual Traffic Manager (vTM) Password Management Vulnerability/Sensitive Data Protection Vulnerability/Principle Of Least Privilege Violation

A vulnerability in vTM could allow an remote attacker to gain unauthorized access to a targeted system. The vulnerability is due to an insufficiently secure derivation method for the zcli “passwordless” account password.

To exploit this issue, an attacker may need access to a trusted or internal networks in which the target vTM resides. This access requirement could reduce the likelihood of a successfully exploit.

A fix for this issue is included in Pulse Secure Virtual Traffic Manager versions 9.9R3, 10.4R2, 17.2R1 and 17.4.

If an upgrade is not possible, administrators are advised to only allow trusted hosts between the clustered vTMs.