PT-2023-23873 · Ivanti · Ivanti Avalanche

Publicado

2023-08-10

·

Atualizado

2025-03-10

·

CVE-2023-32560

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions 6.4.0.0 and earlier
Description An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. The issue is related to two stack-based buffer overflows in Ivanti Avalanche WLAvanacheServer.exe. These buffer overflows can be exploited remotely without user authentication.
Recommendations For Ivanti Avalanche versions 6.4.0.0 and earlier, update to version 6.4.1 to fix the issue. As a temporary workaround, consider restricting access to the vulnerable WLAvanacheServer.exe to minimize the risk of exploitation.

Exploit

Correção

RCE

Memory Corruption

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20CWE-787

Identificadores relacionados

CVE-2023-32560

Produtos afetados

Ivanti Avalanche