PT-2006-6946 · Citrix · Citrix Presentation Server Client

Aaron Portnoy + 1 · Publicado 2006-12-08 · Atualizado 2018-10-17 · CVE-2006-6334

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Citrix Presentation Server Client versions prior to 9.230 for Windows

Description A heap-based buffer overflow issue exists in the SendChannelData function within wfica.ocx. This allows remote malicious websites to execute arbitrary code by manipulating the DataSize parameter to be less than the length of the Data buffer.

Recommendations For versions prior to 9.230, update to version 9.230 or later to resolve the issue. As a temporary workaround, consider restricting access to the SendChannelData function until a patch is applied. Avoid using the DataSize parameter in the affected function with values less than the length of the Data buffer until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-6334

Produtos afetados

Citrix Presentation Server Client

Referências · 14

• 🔥 http://support.citrix.com/article/CTX111827 · Exploit
• 🔥 http://tippingpoint.com/security/advisories/TSRT-06-15.html · Exploit
• 🔥 https://exploit-db.com/exploits/5106 · Exploit
• http://vupen.com/english/advisories/2006/4865 · Nota
• http://kb.cert.org/vuls/id/210969 · Nota
• http://securityfocus.com/archive/1/453760/100/0/threaded · Nota
• http://securitytracker.com/id?1017343 · Aviso do Fabricante
• http://securityfocus.com/bid/21458 · Aviso do Fabricante
• http://fortconsult.net/files/fortconsult.dk/citrix_advisory_dec2006.pdf · Nota
• http://secunia.com/advisories/23246 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-6334 · Nota de Segurança
• http://citrix.com/English/SS/downloads/downloads.asp?dID=2755 · Aviso do Fabricante
• http://securityreason.com/securityalert/1995 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30740 · Nota