PT-2024-2932 · Ivanti · Ivanti Policy Secure+1

Published 2024-04-04 · Updated 2024-10-03 · CVE-2024-22053

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions 9.x through 22.x Ivanti Policy Secure (affected versions not specified)

Description A heap overflow vulnerability in the IPSec component allows an unauthenticated malicious user to send specially crafted requests to crash the service, causing a DoS attack or, in certain conditions, read contents from memory. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For Ivanti Connect Secure versions 9.x through 22.x: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For Ivanti Policy Secure: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

CWE-703

Related Identifiers

BDU:2024-03097

CVE-2024-22053

Affected Products

Ivanti Connect Secure

Ivanti Policy Secure

References · 19

• https://osv.dev/vulnerability/CVE-2024-22053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22053 · Security Note
• https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03097 · Security Note
• https://t.me/cvenotify/75774 · Telegram Post
• https://t.me/cvenotify/96989 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1776019002579411386 · Twitter Post
• https://twitter.com/rfwaveio/status/1776251061394715017 · Twitter Post
• https://t.me/cvenotify/96991 · Telegram Post
• https://t.me/cvenotify/75772 · Telegram Post
• https://twitter.com/ncsc_gov_ie/status/1776280503273840711 · Twitter Post
• https://t.me/cvenotify/75828 · Telegram Post
• https://t.me/cvenotify/75829 · Telegram Post
• https://t.me/cvenotify/75773 · Telegram Post
• https://t.me/true_secator/5600 · Telegram Post