AWS Security Update: CVE-2024-30164 and CVE-2024-30165 Flaws Found in Client VPN
Amazon Web Services (AWS) has issued a security bulletin regarding two vulnerabilities discovered in its Client VPN service. These flaws, identified as CVE-2024-30164 and CVE-2024-30165, could potentially allow malicious actors with access to a user’s device to execute arbitrary commands with elevated privileges, including escalating to root access.
Image: AWS
Vulnerability Details:
- CVE-2024-30164: Affects all platforms of AWS Client VPN.
- CVE-2024-30165: Specifically impacts macOS versions of AWS Client VPN prior to 3.9.1.
Both vulnerabilities stem from buffer overflow issues, a common programming error that can be exploited to overwrite memory and gain unauthorized control over a system.
Impact and Urgency:
The impact of these vulnerabilities is severe, as successful exploitation could lead to complete compromise of an affected device. Attackers could gain access to sensitive data, install malware, or disrupt system operations. Given the widespread use of AWS Client VPN for secure remote access, the potential for widespread exploitation is a significant concern.
AWS has acted swiftly to address these vulnerabilities, releasing updated versions of the Client VPN software for all supported platforms. However, the onus is on users to promptly apply these updates to mitigate the risk.
Mitigation:
AWS strongly recommends that all Client VPN users upgrade to the following versions or higher:
These updated versions contain fixes for both CVE-2024-30164 and CVE-2024-30165, effectively closing the security gaps and preventing exploitation.
Related Posts:
- Facebook closes some APIs to protect user information
- SonicWall Patches Unauthenticated DoS Flaw (CVE-2024-40764) in SonicOS IPSec VPN
- New Research Exposes VPN Vulnerability: Port Shadow Attacks Undermine User Privacy
- OpenVPN Addresses False Zero-Day Claims, Releases Security Patches
- Technical Details Released for Check Point Remote Access VPN 0-Day Flaw
