CVE-2020-13771: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

Various components in Ivanti Endpoint Manager through version 2020.1.1 contain a DLL search order hijacking vulnerability. The vulnerability affects multiple system components including ldiscn32.exe, IpmiRedirectionService.exe, LDAPWhoAmI.exe, and ldprofile.exe. This vulnerability was discovered and disclosed in April 2020 (JUMPSEC Labs).

The vulnerability occurs when affected services running as 'NT AUTHORITY\SYSTEM' attempt to load DLL libraries that are not present on the filesystem, relying on Windows' DLL search order. The vulnerability has been assigned a CVSS 3.1 base score of 7.8 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as CWE-427 (Uncontrolled Search Path Element) (NVD).

A successful exploitation of this vulnerability could allow an attacker to gain code execution and elevation of privileges to the level of privilege held by the vulnerable component (such as NT AUTHORITY\SYSTEM). This could potentially lead to complete system compromise (JUMPSEC Labs).

The vulnerability requires local access to the affected system. An attacker would need to be able to place a malicious DLL file in one of the directories searched by the Windows DLL search order, such as one listed in the PATH system environment variable (JUMPSEC Labs).

The vendor has released updates (versions 2019.1.4 and 2020.1.1) that partially address the vulnerability. However, some instances of the vulnerability remain outstanding. Organizations are advised to review their host configurations and monitor for suspicious activity (JUMPSEC Labs).