Ivanti has addressed a SQL Injection vulnerability in its Endpoint Management (EPM) software. This vulnerability, tracked as CVE-2024-37381 with a CVSS score of 8.4, could have enabled authenticated attackers within the same network to execute arbitrary code on affected systems.
The EPM software, designed to streamline management of device platforms like Windows, macOS, Chrome OS, and IoT, is widely utilized across various industries. The patch provides a crucial defense against potential attackers seeking to leverage the vulnerability to gain unauthorized access or execute malicious code.
Ivanti has released a Security Hot Patch specifically for EPM 2024 flat. The patch involves updating four crucial DLL files on the Core Server, ensuring the vulnerability is effectively mitigated. Ivanti has not received any reports of exploitation in the wild, it urges all users of EPM 2024 flat to promptly apply the available security hot patch.
Organizations relying on Ivanti EPM are strongly advised to prioritize the application of the security hot patch to protect their systems and data from potential compromise.
Steps to Apply Security Patches
- Security Hot Patch to be download on their official support page.
- Before replacing the original files, ensure they are unblocked using PowerShell.
- The new DLLs need to be placed in the following directories:
| Filename | Location on EPM Core |
| PatchApi.dll | C:\Program Files\LANDesk\ManagementSuite\patchapi\bin |
| MBSDKService.dll | C:\Program Files\LANDesk\ManagementSuite\LANDesk\mbsdkservice\bin C:\Program Files\LANDesk\ManagementSuite\ldmain\landesk\mbsdkservice\bin |
4 Administrators can use the provided PowerShell script for an automated update process:
- Extract the EPM_2024_hotpatch folder and place it in the specified directory.
- Open PowerShell as an administrator and run JulyEPM2024HotPatch.ps1.
5 After replacing the DLLs, either reboot the Core Server or, if rebooting is not an option, close the EPM Console and run IISRESET to ensure the new DLLs are loaded.
