Unauthenticated Stack Buffer Overflows in Ivanti Avalanche

A researcher at Tenable discovered multiple stack-based buffer overflows in Ivanti Avalanche WLAvanacheServer.exe v6.4.0.0

A message sent to WLAvalancheService.exe on TCP port 1777 has the following structure:

// be = big-endian
struct item
{
   be32 type;  // data type, valid: 1-9, 100-102 
   be32 NameSize;
   be32 ValueSize;
   byte name[NameSize];
   byte value[ValueSize];  // format depends on @type
                           // 3 - hex string
                           // 9 - list of decimal strings separated by ;
};

// header …