Kaseya patches platform hole

By on
Kaseya patches platform hole

Kaseya has patched a vulnerability in its managed service offering disclosed at the Kiwicon event over the weekend.

The company worked quickly to fix the hole and had a patch ready hours after being notified by CRN sister site SC about the then zero-day flaw.

An automatic hotfix capability in the platform meant users who had the default updating service active would be protected.

"Each system checks for new hotfixes every 24 hours. So our partners don't have to do anything except enable it," president Mark Sutherland told SC.

In the demonstration, the security researcher created an administrator account on Kaseya by injecting malicious script into a registry key used by the Kaseya user agent.

This was accepted by the Managed Service Provider due to a now patched vulnerability in which it failed to properly validate its database.

The researcher confirmed to Kaseya that the hole was patched.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

You must be a registered member of CRN to post a comment.
| Register

Log In

Username / Email:
Password:
  |  Forgot your password?