Ivanti Rushes Patches for 4 New Flaw in Connect Secure and Policy Secure

Ivanti has introduced security updates to address four security flaws impacting Join Protected and Plan Secure Gateways that could outcome in code execution and denial-of-support (DoS).

The checklist of flaws is as follows –

• CVE-2024-21894 (CVSS rating: 8.2) – A heap overflow vulnerability in the IPSec element of Ivanti Hook up Secure (9.x, 22.x) and Ivanti Policy Safe will allow an unauthenticated destructive consumer to send out specially crafted requests in order to crash the services therefore creating a DoS attack. In certain situations, this might lead to execution of arbitrary code.

• CVE-2024-22052 (CVSS rating: 7.5) – A null pointer dereference vulnerability in IPSec part of Ivanti Connect Safe (9.x, 22.x) and Ivanti Policy Protected will allow an unauthenticated destructive person to send out specially crafted requests in order to crash the assistance therefore creating a DoS attack.

• CVE-2024-22053 (CVSS rating: 8.2) – A heap overflow vulnerability in the IPSec ingredient of Ivanti Join Protected (9.x, 22.x) and Ivanti Coverage Secure makes it possible for an unauthenticated malicious person to send specially crafted requests in order to crash the provider thus causing a DoS attack or in certain disorders read contents from memory.

• CVE-2024-22023 (CVSS score: 5.3) – An XML entity enlargement or XEE vulnerability in SAML element of Ivanti Connect Safe (9.x, 22.x) and Ivanti Plan Safe will allow an unauthenticated attacker to send specially crafted XML requests in buy to briefly bring about useful resource exhaustion therefore ensuing in a limited-time DoS.

The corporation, which has been grappling with a continual stream of security flaws in its goods due to the fact the start off of the calendar year, reported it is really not conscious of “any prospects remaining exploited by these vulnerabilities at the time of disclosure.”

Late past thirty day period, Ivanti shipped patches for critical shortcoming in its Standalone Sentry product (CVE-2023-41724, CVSS rating: 9.6) that could allow an unauthenticated threat actor to execute arbitrary commands on the underlying functioning technique.

It also settled yet another critical flaw impacting on-premises versions of Neurons for ITSM (CVE-2023-46808, CVSS rating: 9.9) that an authenticated distant attacker could abuse in purchase to execute arbitrary file writes and get code execution.

In an open up letter published on April 3, 2023, Ivanti’s CEO Jeff Abbott claimed the business is getting a “near look” at its have posture and procedures to fulfill the prerequisites of the present threat landscape.

Abbott also said “functions in current months have been humbling” and that it is executing a plan that effectively variations its security working product by adopting protected-by-style and design ideas, sharing facts with customers with entire transparency, and rearchitecting its engineering, security, and vulnerability management tactics.

“We are intensifying our inner scanning, manual exploitation and tests abilities, participating trusted third parties to augment our inside study and facilitating dependable disclosure of vulnerabilities with greater incentives all over an increased bug bounty software,” Abbott stated.

Located this write-up appealing? Adhere to us on Twitter  and LinkedIn to read extra exceptional articles we submit.

Some parts of this article are sourced from:
thehackernews.com