PT-2002-3138 · Citrix · Metaframe Presentation Server+2

Publicado 2002-12-31 · Atualizado 2011-03-08 · CVE-2002-2426

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Citrix Presentation Server versions 4.0 through 4.5 MetaFrame Presentation Server version 3.0 Access Essentials versions 1.0 through 2.0

Description A cross-site request forgery issue allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection.

Recommendations For Citrix Presentation Server versions 4.0 through 4.5, consider restricting access to the InitialProgram key in ICA connections to prevent unauthorized execution of applications. For MetaFrame Presentation Server version 3.0, restrict access to the InitialProgram key in ICA connections to minimize the risk of exploitation. For Access Essentials versions 1.0 through 2.0, avoid using the InitialProgram key in ICA connections until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2002-2426

Produtos afetados

Access Essentials

Citrix Presentation Server

Metaframe Presentation Server

Referências · 9

• http://vupen.com/english/advisories/2007/3870 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-2426 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2426 · Nota
• http://securitytracker.com/id?1018962 · Nota
• http://secunia.com/advisories/27633 · Aviso do Fabricante
• http://support.citrix.com/article/CTX115245 · Nota
• http://securityfocus.com/bid/26451 · Nota
• http://gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor · Nota
• http://packetstormsecurity.org/0210-exploits/hackingcitrix.txt · Nota