CVE-2024-29204

The vulnerability results from a heap buffer overflow error (heap overflow, CWE-122) in the WLAvalancheService component. An attacker can send a specially crafted network request to the vulnerable service without any authentication. The heap buffer overflow allows overwriting critical data structures in the process memory, which ultimately enables taking control of its execution and running arbitrary code.

An unauthenticated remote attacker can execute arbitrary system commands on the server, which in practice means complete takeover of the vulnerable system, data disclosure, modification or destruction.

Ivanti Avalanche should be updated to version 6.4.3 or newer. Detailed information about available patches is available in the official security bulletin from the vendor: https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed

Ivanti Avalanche in all versions before 6.4.3 (WLAvalancheService component)