Flash Notice: Ivanti Patches Two Dozen Vulnerabilities

overview

Ivanti patched over two dozen vulnerabilities in Ivanti Avalanche this week, including two critical vulnerabilities tracked as CVE-202424966 and CVE-2024-29204. The published vulnerabilities range from medium to critical severity, with risks including information disclosure, command execution, and Denial-of-Service (DoS) attacks. 

CVE-2024-24996 and CVE-2024-29204 (CVSS: 9.8) 

CVE-2024-24996 and CVE-2024-29204 are both heap overflow vulnerabilities. CVE-2024-24996 impacts the WLInfoRailService component, while CVE-2024-29204 affects the WLAvalancheService component of Ivanti Avalanche. Exploitation of both vulnerabilities can occur without any pre-conditions being met, and they do not require user interaction. Tenable has disclosed a Proof of Concept (PoC) for CVE-2024-29204, which can be exploited by sending messages to Avalanche’s WLAvalancheService.exe on TCP port 1777. 

Ivanti’s update also addresses 25 other vulnerabilities of medium to high severity. Some of those vulnerabilities include:  

• Path Traversal  
  • CVE-2024-23535 (CVSS: 8.8) 
  • CVE-2024-24992 (CVSS: 8.8) 
  • CVE-2024-24994 (CVSS: 8.8) 
  • CVE-2024-24997 (CVSS: 8.8) 
  • CVE-2024-24998 (CVSS: 8.8) 
  • CVE-2024-24999 (CVSS: 8.8) 
  • CVE-2024-25000 (CVSS: 8.8) 
  • CVE-2024-27976 (CVSS: 8.8) 
• Race Condition (TOCTOU) 
  • CVE-2024-24993 (CVSS: 8.8) 
  • CVE-2024-24995 (CVSS: 8.8) 
• Unrestricted File-Upload 
  • CVE-2024-23534 (CVSS: 8.8) 

All versions of Avalanche preceding version 6.4.3 are susceptible to these vulnerabilities. The full list of vulnerabilities and their details can be found in the Ivanti advisory. Ivanti and Avertium advise users to apply the patches immediately by upgrading to the latest version, 6.4.3.  

avertium's recommendationS

• CVE-2024-29204, please see Ivanti’s advisory for patch guidance.  
• CVE-2024-24996, please see Ivanti’s advisory for patch guidance.  

INDICATORS OF COMPROMISE (IoCs)

At this time, there are no known IoCs associated with the above vulnerabilities. Avertium remains vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.   

How Avertium is Protecting Our CUSTOMERS

• Expanding endpoints, cloud computing environments, and accelerated digital transformation have decimated the perimeter in an ever-expanding attack surface. Avertium offers Attack Surface Management, so you’ll have no more blind spots, weak links, or fire drills. See every threat in your attack surface, every device, every entry point, and every vulnerability. Our Attack Surface Management services include:  
  • Risk Assessments 
  • Pen Testing and Social Engineering  
  • Infrastructure Architecture and Integration  
  • Zero Trust Network Architecture 
  • Vulnerability Management 

SUPPORTING DOCUMENTATION