CVE-2023-46216

An attacker sends specially crafted network packets to the Mobile Device Server component operating within Ivanti Avalanche. Improper processing of this data leads to writing outside the allocated memory area (CWE-787 — out-of-bounds write), causing memory corruption of the process. This state can be exploited to gain control over program execution flow (RCE) or cause its crash (DoS).

An attacker can gain full control over the server through remote code execution (RCE) or cause unavailability of the mobile device management service (DoS). The attack requires no authentication or user interaction.

Ivanti Avalanche should be updated to version 6.4.2 or later according to information contained in vendor release notes available at the address indicated in the references. It is also recommended to restrict network access to the Mobile Device Server port exclusively to trusted hosts using a firewall.

Ivanti Avalanche — versions prior to 6.4.2 (according to vendor references); Microsoft Windows environment as the platform hosting the Mobile Device Server component