Ivanti Releases Security Updates for Multiple Critical Vulnerabilities Affecting Avalanche
Ivanti security updates address twenty two vulnerabilities, thirteen of which are known to be critical severity, affecting Avalanche
Summary
Ivanti security updates address twenty two vulnerabilities, thirteen of which are known to be critical severity, affecting Avalanche
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
Ivanti has released a security advisory addressing multiple vulnerabilities in Avalanche enterprise mobile device management (MDM) solution. The vulnerabilities vary in type and consist of thirteen critical, eight high and one medium.
The vulnerabilities of highest criticality are highlighted in the vulnerability details.
Vulnerability Details
- CVE-2023-41727 - CWE-787 - Out-of-bounds Write
This is a critical severity unauthenticated buffer overflow vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46216 - CWE-787 - Out-of-bounds Write
This is a critical severity unauthenticated buffer overflow vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46217 - CWE-787 - Out-of-bounds Write
This is a critical severity unauthenticated buffer overflow vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46220 - CWE-787 - Out-of-bounds Write
This is a critical severity Stack-based Buffer Overflow Remote Code Execution Vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46221 - CWE-787 - Out-of-bounds Write
This is a critical severity Stack-based Buffer Overflow Remote Code Execution Vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46222 - CWE-787 - Out-of-bounds Write
This is a critical severity Stack-based Buffer Overflow Remote Code Execution Vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46223 - CWE-787 - Out-of-bounds Write
This is a critical severity Stack-based Buffer Overflow Remote Code Execution Vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46224 - CWE-787 - Out-of-bounds Write
This is a critical severity Stack-based Buffer Overflow Remote Code Execution Vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46225 - CWE-787 - Out-of-bounds Write
This is a critical severity Stack-based Buffer Overflow Remote Code Execution Vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46257 - CWE-787 - Out-of-bounds Write
This is a critical severity Stack-based Buffer Overflow Remote Code Execution Vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46258 - CWE-787 - Out-of-bounds Write
This is a critical severity Stack-based Buffer Overflow Remote Code Execution Vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46259 - CWE-787 - Out-of-bounds Write
This is a critical severity TV_FC Stack-based Buffer Overflow Remote Code Execution Vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution. - CVE-2023-46261 - CWE-787 - Out-of-bounds Write
This is a critical severity Heap-based Buffer Overflow Remote Code Execution Vulnerability with a CVSS score of 9.8. An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service(DoS) or code execution.
Remediation advice
Affected organisations are encouraged to review the following Ivanti Security Advisory and apply the relevant updates.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 21 December 2023 4:01 pm