Ivanti has released fixes for more than two dozen vulnerabilities plaguing its Avalanche mobile device management (MDM) offering, including for two critical severity flaws that could be abused to execute code remotely.
In the accompanying security advisory Avalanche said the two flaws are tracked as CVE-2024-24996, and CVE-2024-29204. Both are described as heap-based buffer overflow bugs, allowing unauthenticated remote threat actors to trigger arbitrary commands on vulnerable endpoints. The attacks are low in complexity and don’t need any interaction on the victim’s side.
Besides these two flaws, Ivanti fixed another 25 bugs of varying severity, which could be abused to mount denial-of-service attacks, run arbitrary commands as SYSTEM, read sensitive information from memory, and more. The company says there is no evidence of real-life abuse just yet, and advises its users to apply the fixes as soon as possible.
What is Ivanti Avalanche?
"We are not aware of any customers being exploited by these vulnerabilities prior to public disclosure. These vulnerabilities were disclosed through our responsible disclosure program," the company said. "To address the security vulnerabilities listed below, it is highly recommended to download the Avalanche installer and update to the latest Avalanche 6.4.3."
The patch and necessary version information can be found on this link.
Ivanti Avalanche is a mobile device management (MDM) solution that helps organizations manage and secure their mobile devices, such as smartphones, tablets, and ruggedized handheld devices. It provides capabilities for device provisioning, configuration management, software distribution, remote troubleshooting, and security enforcement.
Avalanche allows IT administrators to centrally manage a diverse fleet of mobile devices across different operating systems (like iOS, Android, Windows) and device types up to over 100,000 devices.
This includes tasks like deploying applications, enforcing security policies, and remotely troubleshooting issues. It's often used in environments where there's a large number of mobile devices deployed, such as in retail, healthcare, logistics, and manufacturing sectors.
Via BleepingComputer
More from TechRadar Pro
- Ivanti tried to patch its VPN security flaws — but just found more problems
- Here's a list of the best firewalls around today
- These are the best endpoint security tools right now
