Ivanti Avalanche Multiple Vulnerabilities

Multiple vulnerabilities exist in Ivanti Avalanche v6.4.1 WLAvalancheService.exe.

CVE-2023-41727 - MuProperty type 100 stack-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

A message sent to WLAvalancheService.exe on TCP port 1777 has the following structure:

// be = big-endian
strut msg
{
   preamble pre;
   hp hdrpay;
};

struct preamble
{
   be32 MsgSize;     // size of hp + 16
   be32 HdrSize;     // size of hp.hdr
   be32 PayloadSize  // size of hp.payload
   be32 unk;
};

// header + payload
struct hp
{
   MuProperty …