SB2024111461 - Multiple vulnerabilities in Ivanti Secure Access Client

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Incorrect default permissions (CVE-ID: CVE-2024-7571)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.

2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-37398)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper validation of cryptographic signature. A local user can execute arbitrary code with elevated privileges.

3) Race condition (CVE-ID: CVE-2024-29211)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition. A local user can exploit the race and escalate privileges on the system.

4) Buffer Over-read (CVE-ID: CVE-2024-9843)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A local user can trigger a buffer over-read and perform a denial of service (DoS) attack.

5) Incorrect permission assignment for critical resource (CVE-ID: CVE-2024-9842)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect permissions assigned to a critical resource. A local user can perform a denial of service (DoS) attack.

6) Buffer overflow (CVE-ID: CVE-2024-38654)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A local privileged user can trigger a buffer overflow and perform a denial of service (DoS) attack.

7) Privilege Defined With Unsafe Actions (CVE-ID: CVE-2024-8539)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper authorization checks. A local user can execute arbitrary code with elevated privileges.

Remediation

Install update from vendor's website.

References

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
• https://www.zerodayinitiative.com/advisories/ZDI-24-1487/