Ivanti has released security updates to fix 13 critical vulnerabilities in its Avalanche enterprise mobile device management (MDM) solution.
Avalanche allows administrators to manage more than 100,000 mobile devices from a single, central location. They can also deploy software and schedule updates.
Ivanti said it has identified vulnerabilities due to “ WLavalancheService stack or heap-based buffer overflow weaknesses .” They were discovered and reported by security researchers at Tenable and Trend Micro’s Zero Day Initiative.
See also: Google: Fixes zero-day vulnerability in Chrome browser
Exploiting them is relatively simple and requires no user interaction. Unauthorized attackers can perform remote code execution on unpatched systems.
“An attacker sending specially crafted data packets to the Mobile Device Server may cause memory corruption, which could lead to a Denial of Service (DoS) or code execution,” Ivanti said.
“To address the security vulnerabilities [..], it is highly recommended to download the Avalanche installer and update to the latest Avalanche 6.4.2. These vulnerabilities affect all supported versions of the products – Avalanche versions 6.3.1 and later. Older versions/releases are also at risk,” the company warns.
See also: F5 BIG-IP: Fake zero-day warnings promote data wipers
The company also fixed eight medium and high severity bugs that could be exploited by attackers for denial of service, remote code execution, and server-side request forgery (SSRF) attacks.
In the past few months, Ivanti has patched other critical vulnerabilities that could also lead to arbitrary code execution if successfully exploited.
In fact, a vulnerability was used to breach the IT systems of twelve Norwegian ministries.
Protection from vulnerabilities
One of the most effective ways to protect your digital assets is to keep your device's software and operating system up to date. These updates often include security patches that can protect your digital assets from the latest threats.
Additionally, using a reliable antivirus can help detect and prevent threats before they cause damage.
See also: Hackers exploit old MS Excel vulnerability to spread Agent Tesla malware
It's also important to use strong passwords .This means passwords should be long, complex, and unique, including a mix of letters, numbers, and symbols.
Finally, using multi-factor authentication (2FA) can provide an extra layer of protection. This means that in addition to your password, you will need to provide a second piece of security, such as a code sent to your mobile phone.
Source: www.bleepingcomputer.com
