dmesg on ICS showing web process crash multiple times with same IP and SP addresses each time

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Saturday, 12-Apr-2025 01:16:44 JST Will Dormann

   in reply to

   And per the excellent folks at watchTowr, we can see what the vulnerability is:
   A stack buffer overflow in X-Forwarded-For

   No need to find a specific endpoint or do something clever. Simply make a web request to anywhere on an ICS system with a large X-Forwarded-For HTTP header and you'll get a stack buffer overflow on the system. 🤦♂️

   And due to the fact that the Ivanti web server does a fork() without a corresponding exec(), we get the same memory layout every single time.

   Now, about Ivanti's use of remediated... The function where the overflow happens just happens to have been rewritten in a way that avoids the overflow.

   Did Ivanti recognize the possibility of a stack buffer overflow and not recognize it as a security issue? Or did they just happen to change code to accidentally avoid the overflow (and decide to use exploit mitigations as well).

   You decide...