CVE-2024-13167
📋 TL;DR
An out-of-bounds write vulnerability in Ivanti Endpoint Manager (EPM) allows remote unauthenticated attackers to cause denial of service by crashing the service. This affects Ivanti EPM 2024 versions before the January-2025 security update and 2022 SU6 versions before the January-2025 security update. Organizations using these vulnerable Ivanti EPM versions are at risk.
💻 Affected Systems
- Ivanti Endpoint Manager (EPM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Ivanti EPM management capabilities, potentially affecting endpoint management across the organization.
Likely Case
Service crashes leading to temporary loss of endpoint management functionality until service restart.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting exposure.
🎯 Exploit Status
The vulnerability requires crafting specific network requests to trigger the out-of-bounds write condition. No authentication is required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: EPM 2024 January-2025 Security Update, EPM 2022 SU6 January-2025 Security Update
Vendor Advisory: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
Restart Required: Yes
Instructions:
1. Download the appropriate security update from Ivanti's support portal. 2. Apply the update to all affected EPM servers. 3. Restart EPM services. 4. Verify successful update installation.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to EPM servers to only trusted management networks
Configure firewall rules to block external access to EPM ports (typically 80/443 and management ports)
Service Monitoring
windowsImplement monitoring and automatic restart for EPM services
Configure service monitoring tools to detect and restart EPM services if they crash
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to EPM servers
- Deploy additional monitoring and alerting for EPM service crashes
🔍 How to Verify
Check if Vulnerable:
Check EPM version in Ivanti EPM console or via registry: HKEY_LOCAL_MACHINE\SOFTWARE\LANDesk\ManagementSuite\VersionCheck Version:
reg query "HKLM\SOFTWARE\LANDesk\ManagementSuite" /v VersionVerify Fix Applied:
Verify installed version matches or exceeds the January-2025 security update version📡 Detection & Monitoring
Log Indicators:
- EPM service crash events in Windows Event Logs
- Unexpected service termination logs
Network Indicators:
- Unusual network traffic patterns to EPM ports from untrusted sources
SIEM Query:
EventID=7034 OR EventID=1000 AND Source="Ivanti EPM Service"