JSA10412 - VU#261869 - Clientless PCS products break web browser's domain-based security models

Clientless PCS products from multiple vendors operate in a way that breaks fundamental browser security mechanisms. An attacker could use these devices to bypass authentication or conduct other web-based attacks.

Please see VU#261869 at www.cert.org for further details.

KB15799 - Pulse Secure recommendations for mitigating VU#261869 provide steps to mitigate the issue using Pulse Secure PCS product features. At the moment there is no solution available, however Pulse Secure continues to explore the best path forward to address all possible exploit paths.

Pulse Secure would like to acknowledge the following customers for bringing this to our attention:
FishNet Security, Inc.
Logica Nederland BV