Ivanti has released security updates to fix 27 vulnerabilities in its Avalanche mobile device management solution, two of them critical heap overflows that can be exploited for remote command execution.
Avalanche is used by enterprise admins to remotely manage, deploy software, and schedule updates across large fleets of over 100,000 mobile devices from a single central location.
As the company explained on Wednesday, the two critical security flaws were found in Avalanche's WLInfoRailService and WLAvalancheService components.
They are both caused by heap-based buffer overflow weaknesses, which can let unauthenticated remote attackers execute arbitrary commands on vulnerable systems in low-complexity attacks that don't require user interaction.
Today, Ivanti also patched 25 medium and high-severity bugs that remote attackers could exploit to trigger denial-of-service attacks, execute arbitrary commands as SYSTEM, read sensitive information from memory, and remote code execution attacks.
Customers can find the latest Avalanche 6.4.3 release here and more information regarding upgrade steps in this support article.
Ivanti patched 13 more critical-severity remote code execution vulnerabilities in the Avalanche MDM solution in December after fixing two other critical Avalanche buffer overflows collectively tracked as CVE-2023-32560 in August.
State-affiliated hackers used two zero-day flaws in Ivanti's Endpoint Manager Mobile, formerly known as MobileIron Core, to breach the networks of multiple Norwegian government organizations one year ago.
Months later, attackers chained a third MobileIron Core zero-day with CVE-2023-35078 to also hack into the IT systems of a dozen Norwegian ministries.
Palo Alto Networks fixes zero-day exploited to backdoor firewalls.
Critical Rust flaw enables Windows command injection attacks.
Windows 10 KB5036892 update released with 23 new fixes, changes.
Windows 11 KB5036893 update released with 29 changes, Moment 5 features.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 16 Apr 2024 19:55:30 +0000