Remediated code only copies 50 bytes to a 50-byte stack buffer.

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Saturday, 12-Apr-2025 01:16:44 JST Will Dormann

   in reply to

   If I look closer at the difference between the vulnerable version and the "remediated" version, it's now clear where the fix is.

   In the vulnerable code, the attacker-provided length of data is strlcopy'd into a 50-byte array. And badness ensues.

   In the "remediated" version, the strlcopy only copies 50 bytes, as the target variable is 50 bytes.

   So I'd consider this an actual fix. But presumably Ivanti didn't realize that a stack buffer overflow could have a security impact? And thus the lack of CVE when it was fixed, or the attempt to also fix their Ivanti Policy Secure and ZTA Gateways products? 🤷♂️