CVE-2015-5369
published 2015-08-11CVE-2015-5369: Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1…
PriorityP422medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.75%
75.2th percentile
Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | pulse_connect_secure | — | — |
| juniper | pulse_connect_secure | — | — |
| juniper | pulse_connect_secure | — | — |
| juniper | pulse_connect_secure | — | — |
| juniper | pulse_connect_secure | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Juniper
CVE-2015-5369: Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and
vendor_juniper·2015-08-11·CVSS 4.3
CVE-2015-5369 [MEDIUM] CWE-17 CVE-2015-5369: Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and
CVE-2015-5369: Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.
GHSA
GHSA-26rc-pv36-f3pg: Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8
ghsa_unreviewed·2022-05-17
CVE-2015-5369 [MEDIUM] CWE-20 GHSA-26rc-pv36-f3pg: Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8
Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://kb.juniper.net/InfoCenter/index?page=content&id=TSB16756http://www.securitytracker.com/id/1033166https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40004https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friendshttp://kb.juniper.net/InfoCenter/index?page=content&id=TSB16756http://www.securitytracker.com/id/1033166https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40004https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friends
2015-08-11
Published