- "기밀 VM의 빈틈을 메운다" 마이크로소프트의 오픈소스 파라바이저 '오픈HCL'란?
- The best early Black Friday AirPods deals: Shop early deals
- The 19 best Black Friday headphone deals 2024: Early sales live now
- I tested the iPad Mini 7 for a week, and its the ultraportable tablet to beat at $100 off
- The best Black Friday deals 2024: Early sales live now
Ivanti Urges Customers to Patch 13 Critical Vulnerabilities
Security vendor Ivanti has released an update to its Avalanche mobile device management (MDM) product which fixes 22 vulnerabilities, 13 of which are rated critical.
Ivanti Avalanche is described by the vendor as an enterprise MDM solution capable of managing distributed deployments of more than 100,000 mobile devices – including anything from warehouse scanners to handheld tablets.
However, its Avalanche 6.4.2 release published this week includes fixes for 13 flaws rated with a CVSS score of 9.8. They are a mix of stack-based buffer overflow remote code execution (RCE) vulnerabilities, heap-based buffer overflow RCE and unauthenticated buffer overflows.
“An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result … [in] code execution,” Ivanti warned in an advisory.
“To address the security vulnerabilities listed …, it is highly recommended to download the Avalanche installer and update to the latest Avalanche 6.4.2. The installation will apply a fix for each CVE listed …. These vulnerabilities affect any older versions of Avalanche (confirmed back to 6.3.1 but likely any 6.X versions are affected).”
Read more on Ivanti patching: Ivanti Discloses Yet Another Critical Flaw
There’s no suggestion the vulnerabilities are currently being exploited in active attacks, but Ivanti MDM products have in the past been targeted by threat actors.
Over the summer, the vendor was forced to patch multiple zero-day vulnerabilities in its Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. CVE-2023-35078 and CVE-2023-35081 were exploited in a likely state-sponsored attacks against several Norwegian government ministries.
“Mobile device management (MDM) systems are attractive targets for threat actors because they provide elevated access to thousands of mobile devices, and APT actors have exploited a previous MobileIron vulnerability,” the US Cybersecurity and Infrastructure Security Agency (CISA) wrote in an advisory at the time.
Alongside the 13 critical-rated vulnerabilities, Ivanti fixed a further nine high and medium severity bugs with its Avalanche 6.4.2 release.