Two unauthenticated stack buffer overflows found in Ivanti Avalanche EMM

9 months ago AndyC

Ivanti Avalanche EMM product is impacted by two buffer overflows collectively tracked as CVE-2023-32560.
Tenable researchers discovered two stack-based buffer overflows, collectively tracked as CVE-2023-32560 (CVSS v3: 9.

Ivanti Avalanche EMM product is impacted by two buffer overflows collectively tracked as CVE-2023-32560.

Tenable researchers discovered two stack-based buffer overflows, collectively tracked as CVE-2023-32560 (CVSS v3: 9.8), impacting the Ivanti Avalanche enterprise mobility management (EMM) solution.

A remote, unauthenticated attacker can trigger the vulnerabilities to execute arbitrary code on vulnerable systems.

The flaw affects Ivanti Avalanche WLAvanacheServer.exe v6.4.0.0 and older.

An attacker can trigger the issue by sending a crafted message to WLAvalancheService.exe on TCP port 1777.

“When processing an item of data type 9, WLAvalancheService.exe uses a fixed-size stack-based buffer to store user-supplied data and then convert the data to an integer using atol(). An unauthenticated remote attacker can specify a long type 9 item to overflow the buffer.” reads the advsisory published by Tenable.

Below is the Disclosure Timeline:

4 April 2023 – Issue reported
12 April 2023 – Tenable requests confirmation that report was received
12 April 2023 – Ivanti confirms the issue is being reviewed
13 April 2023 – Ivanti requests proof of concept script
13 April 2023 – Tenable notes the poc must have been removed from initial report, sends PoC
19 April 2023 – Ivanti confirms the issue and indicates they are working on a fix
22 June 2023 – Ivanti notes that a fix may not be ready by the end of the 90 day window.
28 June 2023 – Tenable extends disclosure window
20 July 2023 – Ivanti informs Tenable a fix will be available on August 1st, and has assigned CVE-2023-32560
14 August 2023 – Initial advisory released

Tenable researchers also created a proof-of-concept and shared it with the vendor on April 13, 2023.

Ivanti addressed the flaw on August 3, 2023, with the release of Avalanche version 6.4.1.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ivanti)

Share On

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts