Advisories

CERT-In Advisory CIAD-2024-0063

Multiple Vulnerabilities in Ivanti Products

Original Issue Date: December 18, 2024

Severity Rating: Critical

Systems Affected

Ivanti Connect Secure versions prior to 22.7R2.4
Ivanti Policy Secure versions prior to 22.7R1.2

Overview

Multiple vulnerabilities have been reported in Ivanti products, which could allow a remote attacker to cause denial of service conditions, execute arbitrary code, and gain access to sensitive information on a targeted system.

Target audience:
Organizations and Individuals using affected Ivanti products

Risk assessment:
High risk of complete system takeover or system instability

Impact assessment:
Potential for data manipulation, ransomware attacks, or complete infrastructure compromise.

Description

Ivanti Connect Secure is a next generation Secure access product, which offers fast and secure connection between remote users and their organization�s wider network.

Ivanti Policy Secure is a network access control (NAC) solution which provides network access only to authorized and secured users and devices.

1. Denial of Service ( CVE-2024-37377   CVE-2024-37401   )

These vulnerabilities exist due to a heap-based buffer overflow and an out-of-bounds read vulnerability in the IPsec component of Ivanti Connect Secure which allow a remote, unauthenticated attacker to trigger denial of service (DoS) condition on the target device.

2. Authentication Bypass ( CVE-2024-9844   )

Insufficient server-side controls in the Secure Application Manager of Ivanti Connect Secure allows a remote authenticated attacker to bypass restrictions.

3. Remote Code Execution ( CVE-2024-11633   CVE-2024-11634   )

Argument injection in Ivanti Connect Secure, or command injection vulnerabilities in both Ivanti Connect Secure and Ivanti Policy Secure, allow a remote authenticated attacker with admin privileges to execute code on the target system. (Not Applicable to the 9.1Rx code train).

Solution

Apply appropriate fixes as mentioned in Ivanti Security Advisory:
https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs

Vendor Information

https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs

CVE Name
CVE-2024-37377
CVE-2024-9844
CVE-2024-37401
CVE-2024-11633
CVE-2024-11634

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India