Security Advisory

Ivanti Product Security Update Advisory

  • Nov 14 2024

Overview
 

An update has been released to address vulnerabilities in Ivanti products. Users of the affected versions are advised to update to the latest version.

 

Affected Products

CVE-2024-9420, CVE-2024-47906
 

  • Ivanti Connect Secure versions: ~ 22.7R2.2 (inclusive)
  • Ivanti Policy Secure versions: ~ 22.7R1.1 (inclusive)

 

CVE-2024-11004, CVE-2024-11005, CVE-2024-11006, CVE-2024-11007, CVE-2024-8495, CVE-2024-38649, CVE-2024-38655

  • Ivanti Connect Secure versions: ~ 22.7R2.1 (inclusive)
  • Ivanti Policy Secure versions: ~ 22.7R1.1 (inclusive)

 

CVE-2024-39709

  • Ivanti Connect Secure versions: ~ 22.6R2 (inclusive)
  • Ivanti Policy Secure versions: ~ 22.7R1 (inclusive)

 

CVE-2024-39710, CVE-2024-39711, CVE-2024-39712

  • Ivanti Connect Secure versions: ~ 22.7R2.1 (inclusive)
  • Ivanti Connect Secure versions: ~ 9.1R18.7 (inclusive)
  • Ivanti Policy Secure versions: ~ 22.7R1.1 (inclusive)

 

CVE-2024-38656

  • Ivanti Connect Secure versions: ~ 22.7R2.2 (inclusive)
  • Ivanti Connect Secure versions: ~ 9.1R18.9 (excluded)
  • Ivanti Policy Secure versions: ~ 22.7R1.1 (inclusive)

 

CVE-2024-37400, CVE-2024-47907

  • Ivanti Connect Secure versions: ~ 22.7R2.2 (inclusive)

 

CVE-2024-7571, CVE-2024-8539, CVE-2024-9842, CVE-2024-29211, CVE-2024-37398

  • Ivanti Secure Access Client versions: ~ 22.7R3 (inclusive)
     

CVE-2024-34787, CVE-2024-32839, CVE-2024-32841, CVE-2024-32844, CVE-2024-32847, CVE-2024-34780, CVE-2024-34781, CVE-2024-34782, CVE-2024-34784, CVE-2024-37376, CVE-2024-50322, CVE-2024-50323, CVE-2024-50324, CVE-2024-50326, CVE-2024-50327, CVE-2024-50328, CVE-2024-50329, CVE-2024-50330

  • Ivanti Endpoint Manager versions: ~ 2024 November Security Update (excluded)
  • Ivanti Endpoint Manager versions: ~ 2022 SU6 November Security Update (excluded)

     

CVE-2024-50317, CVE-2024-50318, CVE-2024-50319, CVE-2024-50320, CVE-2024-50321, CVE-2024-50331

  • Ivanti Avalanche versions: ~ 6.4.5 (inclusive)
     

 

Resolved Vulnerabilities

 

Vulnerability that allows remote authentication attackers to achieve remote code execution via disable (CVE-2024-9420)

Vulnerability where excessive binary privileges exist, allowing a local authenticated attacker to escalate privileges (CVE-2024-47906)

Reflected XSS vulnerability that could allow a remote, unauthenticated attacker to gain administrator privileges (CVE-2024-11004)

Command injection vulnerabilities that allow remote authenticated attackers with administrator privileges to execute remote code (CVE-2024-11005, CVE-2024-11006, CVE-2024-11007)

Null pointer dereference vulnerabilities that allow remote, unauthenticated attackers to cause a denial of service (CVE-2024-50317, CVE-2024-50318, CVE-2024-8495)

Out-of-bounds write vulnerability that could allow a remote, unauthenticated attacker to cause a denial of service (CVE-2024-38649)

Vulnerability with incorrect file permissions that could allow a local authenticated attacker to escalate privileges (CVE-2024-39709)

Argument injection vulnerabilities that allow remote authenticated attackers with administrator privileges to achieve remote code execution (CVE-2024-38655, CVE-2024-39710, CVE-2024-39711, CVE-2024-39712)

Argument injection vulnerability that could allow remote code execution by a remote authenticated attacker with administrator privileges (CVE-2024-38656)

An out-of-bounds read error could allow a remote, unauthenticated attacker to cause an infinite loop, resulting in a denial of service (DoS) condition (CVE-2024-37400)

Stack-based buffer overflow vulnerability that could allow a remote, unauthenticated attacker to cause a denial of service (CVE-2024-47907)

Vulnerability that could allow a locally authenticated attacker to escalate their privileges due to improper authorization (CVE-2024-7571)

Vulnerability that could allow a locally authenticated attacker to modify sensitive configuration files due to improper authorization (CVE-2024-8539)

Vulnerability that could allow a local authenticated attacker to create arbitrary folders due to improper permissions (CVE-2024-9842)

Race condition vulnerability that could allow a local authenticated attacker to modify sensitive configuration files (CVE-2024-29211)

Insufficient validation, which could allow a local authenticated attacker to escalate their privileges (CVE-2024-37398)

Path traversal vulnerabilities that could allow an unauthenticated attacker to achieve code execution (CVE-2024-34787, CVE-2024-50322)

SQL injection vulnerability that could allow an unauthenticated attacker to achieve code execution (CVE-2024-50323)

Path traversal vulnerability that could allow remote authenticated attackers with administrator privileges to achieve remote code execution (CVE-2024-50324)

SQL injection vulnerabilities that allow remote authenticated attackers with administrator privileges to achieve remote code execution (CVE-2024-32839, CVE-2024-32841, CVE-2024-32844, CVE-2024-32847, CVE-2024-34780, CVE-2024-37376, CVE-2024-34781, CVE-2024-34782, CVE-2024-34784, CVE-2024-50326)

SQL injection vulnerabilities that allow remote, unauthenticated attackers to achieve remote code execution (CVE-2024-50327, CVE-2024-50328, CVE-2024-50330)

Path traversal vulnerability that could allow a remote, unauthenticated attacker to achieve remote code execution (CVE-2024-50329)

Infinite loop vulnerability that could allow a remote, unauthenticated attacker to cause a denial of service (CVE-2024-50319, CVE-2024-50320, CVE-2024-50321)

Out-of-bounds read vulnerability that could allow a remote, unauthenticated attacker to exfiltrate sensitive information from memory (CVE-2024-50331)

 

 

Vulnerability Patches

Vulnerability patches have been made available in the latest updates. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.

 

CVE-2024-9420, CVE-2024-47906, CVE-2024-11004, CVE-2024-11005, CVE-2024-11006, CVE-2024-11007, CVE-2024-8495, CVE-2024-38649, CVE-2024-38655, CVE-2024-39709

  • Ivanti Connect Secure version: 22.7R2.3
  • Ivanti Policy Secure version: 22.7R1.2

 

CVE-2024-39710, CVE-2024-39711, CVE-2024-39712

  • Ivanti Connect Secure version: 22.7R2.3
  • Ivanti Connect Secure version: 9.1R18.9
  • Ivanti Policy Secure version: 22.7R1.2

 

CVE-2024-38656

  • Ivanti Connect Secure version: 22.7R2.3
  • Ivanti Connect Secure version: 9.1R18.9
  • Ivanti Policy Secure version: 22.7R1.2

 

CVE-2024-37400, CVE-2024-47907

  • Ivanti Connect Secure version: 22.7R2.3

 

CVE-2024-7571, CVE-2024-8539, CVE-2024-9842, CVE-2024-29211, CVE-2024-37398

  • Ivanti Secure Access Client version: 22.7R4

 

CVE-2024-34787, CVE-2024-32839, CVE-2024-32841, CVE-2024-32844, CVE-2024-32847, CVE-2024-34780, CVE-2024-34781, CVE-2024-34782, CVE-2024-34784, CVE-2024-37376, CVE-2024-50322, CVE-2024-50323, CVE-2024-50324, CVE-2024-50326, CVE-2024-50327, CVE-2024-50328, CVE-2024-50329, CVE-2024-50330

  • Ivanti Endpoint Manager version: 2024 November Security Update
  • Ivanti Endpoint Manager version: 2022 SU6 November Security Update

 

CVE-2024-50317, CVE-2024-50318, CVE-2024-50319, CVE-2024-50320, CVE-2024-50321, CVE-2024-50331

  • Ivanti Avalanche version: 6.4.6

 

 

Referenced Sites

[1] Security Advisory EPM November 2024 for EPM 2024 and EPM 2022 SU6

https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022?language=en_US

[2] Security Advisory Ivanti Avalanche (Multiple CVEs) – Q4 2024 Release

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release?language=en_US&_gl=1*pchng3*_gcl_au*ODM2NTAyMzg1LjE3MjY2NjkwMTg

[3] Security Advisory Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), Ivanti Secure Access Client (ISAC)

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs?language=en_US

Tags:

Previous Post

Next Post