Educause Security Discussion mailing list archives
Re: Pulse Secure VPN
From: Sidharth Nandury <nandurys () DENISON EDU>
Date: Wed, 22 Jan 2020 08:38:10 -0500
Hi Razi, I couldn't find anything obvious in the roles that would allow me to choose one or the other. Have you created a support call? I would be interested to hear if there is a resolution for this. Thank you. Regards, Sid On Tue, Jan 21, 2020 at 5:38 PM Francisco Chavez <fac3 () stmarys-ca edu> wrote:
Razi, I am not sure how to achieve what you are attempting but I did want to share a KB article relating to a serious vulnerability with Pulse Connect. In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability. You are probably aware of this already but I figured I would share just in case. I have included links to the NIST CVE as well as the Pule KB article. (NIST) - https://nvd.nist.gov/vuln/detail/CVE-2019-11510 (Pulse Secure) - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ Regards, Francisco Chavez Manager - IT Security fac3 () stmarys-ca edu Office: (925) 631-8236 On Jan 21, 2020, at 2:26 PM, Julian Y Koh <kohster () NORTHWESTERN EDU> wrote: On Jan 21, 2020, at 16:00, Razi Ahmad <razi.ahmad () STERN NYU EDU> wrote: I'd like to know if anyone is using Pulse Secure and if so, do you know of a way to disable client login while still allowing web login to the appliance? The reason for this is that we offer web-based access to network drives via this service and don't want to completely turn this off until the replacement we are working on is ready to go. It’s been a while since I’ve directly managed our Pulse Secure environment, but you can definitely disable use of the different access options on a role by role basis. So we had some roles that are web access only, some that have web access + JSAM, and other that had web access + Pulse Secure (nee Network Connect), etc. -- Julian Y. Koh Associate Director, Telecommunications and Network Services Northwestern Information Technology 2020 Ridge Avenue #331 Evanston, IL 60208 +1-847-467-5780 Northwestern IT Web Site: <http://www.it.northwestern.edu/> PGP Public Key: <https://bt.ittns.northwestern.edu/julian/pgppubkey.html> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community
-- [image: Denison University Logo] <https://denison.edu> *Sidharth S. Nandury* *Network Engineer* Information Technology Services 100 West College Street, Granville, OH 43023 <https://deniso.nu/2qF6h7M> | Fellows 003C <https://denison.edu/map> Office: 740-587-5533 | Mobile: 516-314-4413 nandurys () denison edu https://denison.edu/campus/technology *Please consider the environment before printing this email.* ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community
Current thread:
- Pulse Secure VPN Razi Ahmad (Jan 21)
- Re: Pulse Secure VPN Julian Y Koh (Jan 21)
- Re: Pulse Secure VPN Francisco Chavez (Jan 21)
- Re: Pulse Secure VPN Sidharth Nandury (Jan 22)
- Re: Pulse Secure VPN Sidharth Nandury (Jan 22)
- Re: Pulse Secure VPN Francisco Chavez (Jan 21)
- Re: Pulse Secure VPN Julian Y Koh (Jan 21)