PT-2023-23873 · Ivanti · Ivanti Avalanche

Published 2023-08-10 · Updated 2025-03-10 · CVE-2023-32560

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions 6.4.0.0 and earlier

Description An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. The issue is related to two stack-based buffer overflows in Ivanti Avalanche WLAvanacheServer.exe. These buffer overflows can be exploited remotely without user authentication.

Recommendations For Ivanti Avalanche versions 6.4.0.0 and earlier, update to version 6.4.1 to fix the issue. As a temporary workaround, consider restricting access to the vulnerable WLAvanacheServer.exe to minimize the risk of exploitation.

Exploit

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-20

CWE-787

Related Identifiers

CVE-2023-32560

Affected Products

Ivanti Avalanche

References · 41

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/ivanti_avalanche_mdm_bof.rb · Exploit
• 🔥 https://exploit-db.com/exploits/51699 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-32560 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32560 · Vendor Advisory
• https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US · Vendor Advisory
• https://twitter.com/RsSI47041968/status/1691136503878242304 · Twitter Post
• http://packetstormsecurity.com/files/174698/Ivanti-Avalanche-MDM-Buffer-Overflow.html · Note
• https://twitter.com/RobelCampbell/status/1692020746212593716 · Twitter Post
• https://t.me/echeloneyes/1879 · Telegram Post
• https://twitter.com/catnap707/status/1691951369031434422 · Twitter Post
• https://twitter.com/_DavidRushmer/status/1691789903862857874 · Twitter Post
• http://packetstormsecurity.com/files/174459/Ivanti-Avalance-Remote-Code-Execution.html · Note
• https://twitter.com/PoseidonTPA/status/1691758727911911475 · Twitter Post
• https://twitter.com/socradar/status/1691812223365124520 · Twitter Post
• https://twitter.com/autumn_good_35/status/1691766296957120841 · Twitter Post