Ivanti Bolsters Security with Patch for Critical Vulnerability in Avalanche Enterprise MDM Solution

Vulnerabilities in Ivanti‘s Avalanche Enterprise MDM Solution

Overview

Ivanti, a leading provider of enterprise mobile device management (MDM) solutions, has recently released patches for several critical and high-severity vulnerabilities in its Avalanche product. These vulnerabilities pose a significant risk to organizations that rely on Avalanche for mobile device management, as they can be exploited to execute arbitrary code, upload arbitrary files, bypass authentication, and potentially gain system privileges. The vulnerabilities were discovered by security researchers at Trend Micro’s ZDI and Tenable.

The Most Severe Vulnerability: CVE-2023-32563

The most severe vulnerability identified in Avalanche is CVE-2023-32563, which has a CVSS score of 9.8. This vulnerability is a directory traversal bug that allows remote attackers to execute arbitrary code without authentication. It exists in the ‘updateSkin’ method of the MDM solution and is the result of a lack of proper validation of user-supplied paths. Exploiting this vulnerability could allow an attacker to execute code in the context of the system.

Stack-Based Buffer Overflow Bugs: CVE-2023-32560

Tenable researchers discovered multiple stack-based buffer overflow bugs in Wavelink Avalanche Manager, a component of Avalanche. These vulnerabilities, collectively tracked as CVE-2023-32560 with a CVSS score of 8.8, can be triggered by an unauthenticated remote attacker sending a crafted message to the service. Exploiting these vulnerabilities could lead to service disruption or code execution.

Other Remote Code Execution Vulnerabilities

Two other high-severity remote code execution vulnerabilities, CVE-2023-32562 and CVE-2023-32564, were reported by ZDI. These vulnerabilities are the result of a lack of proper validation of user-supplied data and allow an attacker to upload arbitrary files and potentially execute code with system privileges.

Authentication Bypass Flaws

The remaining three vulnerabilities, CVE-2023-32561, CVE-2023-32565, and CVE-2023-32566, are described as authentication bypass flaws in various components of the Avalanche MDM solution. These vulnerabilities allow an attacker to bypass authentication and potentially gain unauthorized access to the system.

Patching and Mitigation

Ivanti has released patches for all seven vulnerabilities in Avalanche version 6.4.1.207, which was released earlier this month. It is imperative for organizations using Avalanche to apply these patches promptly to protect their systems from potential exploitation.

The Importance of Vigilance and Proactive Security Measures

The discovery of these vulnerabilities in Ivanti‘s Avalanche product highlights the ongoing need for organizations to remain vigilant about their cybersecurity measures. It serves as a reminder that even trusted and widely-used solutions can have vulnerabilities that can be exploited by malicious actors. This incident underscores the importance of proactive security measures, such as rigorous code review, security testing, and prompt patching.

The Role of Responsible Disclosure

It is worth noting that both Tenable and ZDI have released details about these vulnerabilities only recently, despite Ivanti having already patched them. While there is no mention of these vulnerabilities being exploited in the wild, it is critical for security researchers and software vendors to work together to ensure responsible disclosure. Promptly disclosing vulnerabilities and releasing patches as soon as possible is crucial to minimizing the risk of exploitation.

Conclusion

The vulnerabilities discovered in Ivanti‘s Avalanche MDM solution highlight the ongoing challenge of securing enterprise software. Organizations must remain proactive in their approach to cybersecurity, regularly applying patches and updates, and conducting thorough security testing. Collaboration between security researchers and software vendors is crucial in ensuring prompt vulnerability disclosure and patching, ultimately protecting organizations from potential cyber attacks.