Kaseya patches platform vulnerability

Powered by SC Magazine
 

Customers receive automatic patch.

Kaseya has patched a hole in its managed service offering disclosed at the Kiwicon event over the weekend.

The company worked quickly to fix the hole and had a patch ready hours after being notified by SC about the then zero-day flaw.

Kiwicon 6 coverage

An automatic hotfix capability in the platform meant users who had the default updating service active would be protected.

"Each system checks for new hotfixes every 24 hours. So our partners don't have to do anything except enable it," President Mark Sutherland told SC.

In the demonstration, the security researcher created an administrator account on Kaseya by injecting malicious script into a registry key used by the Kaseya user agent. This was accepted by the Managed Service Provider due to a now patched vulnerability in which it failed to properly validate its database.

The researcher confirmed to Kaseya that the hole was patched.

Copyright © SC Magazine, Australia


Kaseya patches platform vulnerability
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  13%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 435

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 209

Vote