Sure, why the heck not? All an SSL VPN tunnel does is provide an SSL
encrypted VPN tunnel between said unsecured/infected machine and your
internval virus protected number, that's all the VPN does. It does not
offer virus protection or threat protection. It created a virtual
tunnel making that said infected computer be almost just like it was
sitting in your internal virus protected network. All a virus has to
do is have logic to look for available networks and then travel across
them, not difficult.

You'd need to have other measures in place to protect your internal
network such as a quarantine that requires a virus scan/clean or
installation on any machine connecting over VPN, or you could secure the
VPN to only allow certain ports of traffic, etc.

-----Original Message-----
From: Beauford, Jason [mailto:jbeauford (at) EightInOnePet (dot) com [email concealed]]
Sent: Thursday, November 18, 2004 5:18 PM
To: focus-virus (at) securityfocus (dot) com [email concealed]
Subject: SSL VPN Tunnels and Virus Transmission

Group,

I want to know if it is possible / plausible that a virus can travel
from an unsecured and infected machine to an internal virus protected
network via an encrypted SSL VPN tunnel?

Thanks in advance.

JMB

[ reply ]