Description
A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | Connect Secure | 22.1R6.2 – < 22.1R6.2, 22.2R4.2 – < 22.2R4.2, 22.3R1.2 – < 22.3R1.2, 22.4R1.2 – < 22.4R1.2, 22.4R2.4 – < 22.4R2.4, 22.5R1.3 – < 22.5R1.3, 22.5R2.4 – < 22.5R2.4, 22.6R2.3 – < 22.6R2.3, 9.1R14.6 – < 9.1R14.6, 9.1R15.4 – < 9.1R15.4, 9.1R16.4 – < 9.1R16.4, 9.1R17.4 – < 9.1R17.4, 9.1R18.5 – < 9.1R18.5 | 22.1R6.2 |
| Ivanti | Policy Secure | 22.4R1.2 – < 22.4R1.2, 22.5R1.3 – < 22.5R1.3, 22.6R1.2 – < 22.6R1.2, 9.1R16.4 – < 9.1R16.4, 9.1R17.4 – < 9.1R17.4, 9.1R18.5 – < 9.1R18.5 | 22.4R1.2 |
Advisories 1
- WID-SEC-2024-0784 Ivanti Connect Secure und Policy Secure: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 24, 2024