PT-2008-1989 · Citrix · Citrix Access Essentials+3

Eric Detoisien · Publicado 2008-01-18 · Atualizado 2018-10-15 · CVE-2008-0356

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Citrix Presentation Server versions 4.5 and earlier Citrix Access Essentials versions 2.0 and earlier Citrix Desktop Server version 1.0

Description The issue is related to a buffer overflow in the Independent Management Architecture (IMA) service. This allows remote attackers to execute arbitrary code by sending a packet with an invalid size value to TCP port 2512 or 2513.

Recommendations For Citrix Presentation Server versions 4.5 and earlier, update to a version that fixes this issue. For Citrix Access Essentials versions 2.0 and earlier, update to a version that fixes this issue. For Citrix Desktop Server version 1.0, update to a version that fixes this issue.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-0356

Produtos afetados

Citrix Access Essentials

Citrix Desktop Server

Citrix Metaframe Presentation Server

Citrix Presentation Server

Referências · 10

• http://support.citrix.com/article/CTX114487 · Correção
• http://vupen.com/english/advisories/2008/0172 · Nota
• http://securityfocus.com/archive/1/486585/100/0/threaded · Nota
• http://zerodayinitiative.com/advisories/ZDI-08-002.html · Nota
• http://securityfocus.com/bid/27329 · Nota
• http://kb.cert.org/vuls/id/412228 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0356 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0356 · Nota de Segurança
• http://securitytracker.com/id?1019231 · Nota
• http://secunia.com/advisories/28508 · Aviso do Fabricante