CVE-2020-13771 Explained : Impact and Mitigation

Various components in Ivanti Endpoint Manager through 2020.1.1 are vulnerable to DLL hijacking, potentially leading to code execution and privilege escalation.

Understanding CVE-2020-13771

What is CVE-2020-13771?

Various components in Ivanti Endpoint Manager through version 2020.1.1 are susceptible to a DLL hijacking vulnerability. This flaw allows an attacker to execute arbitrary code and elevate privileges under specific conditions.

The Impact of CVE-2020-13771

The vulnerability could result in an attacker gaining code execution capabilities and elevating privileges to the level of the vulnerable component, such as NT AUTHORITY\SYSTEM. Affected components include ldiscn32.exe, IpmiRedirectionService.exe, LDAPWhoAmI.exe, and ldprofile.exe.

Technical Details of CVE-2020-13771

Vulnerability Description

The issue arises from various components in Ivanti Endpoint Manager relying on Windows search order when loading a non-existent library file, enabling DLL hijacking.

Affected Systems and Versions

Product: Ivanti Endpoint Manager
Versions affected: Through 2020.1.1

Exploitation Mechanism

The vulnerability allows an attacker to place a malicious DLL file in a specific location to be loaded by the vulnerable component, leading to code execution and privilege escalation.

Mitigation and Prevention

Immediate Steps to Take

Apply security patches provided by Ivanti promptly.
Implement DLL search order mitigation techniques.

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities.
Monitor and restrict DLL loading mechanisms to prevent DLL hijacking attacks.

Patching and Updates

Ivanti has released patches to address the vulnerability. Ensure all affected systems are updated to the latest secure versions.