PT-2023-8293 · Ivanti · Ivanti Avalanche

Published 2023-12-18 · Updated 2024-01-11 · CVE-2023-46803

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions (affected versions not specified)

Description The issue is related to insufficient exception handling in the WLAvalancheService of the Ivanti Avalanche mobile device management system. An attacker can exploit this by sending specially crafted data packets to the Mobile Device Server, potentially causing memory corruption and resulting in a Denial of Service (DoS). This could allow a remote attacker to cause the service to become unavailable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Memory Corruption

Weakness Enumeration

CWE-755

CWE-787

Related Identifiers

BDU:2024-00377

CVE-2023-46803

ZDI-24-067

Affected Products

Ivanti Avalanche

References · 9

• https://zerodayinitiative.com/advisories/ZDI-24-067 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46803 · Security Note
• https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00377 · Security Note
• https://twitter.com/CVEnew/status/1737138845244899348 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1737167237130117301 · Twitter Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-22544 · Note
• https://forums.ivanti.com/s/article/Avalanche-6-4-2-Security-Hardening-and-CVEs-addressed?language=en_US · Note