PT-2008-3790 · Citrix · Ica Basic+5

Publicado 2008-05-18 · Atualizado 2017-08-08 · CVE-2008-2299

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Citrix Presentation Server versions 4.5 and earlier Citrix Access Essentials versions 2.0 and earlier Citrix Desktop Server version 1.0

Description: The issue allows clients to use weaker encryption settings than configured by the administrator, potentially enabling attackers to bypass intended restrictions. This is due to an unspecified vulnerability in SecureICA and ICA Basic encryption.

Recommendations: For Citrix Presentation Server versions 4.5 and earlier, update the configuration to enforce stronger encryption settings. For Citrix Access Essentials versions 2.0 and earlier, restrict the use of weaker encryption protocols until a fix is available. For Citrix Desktop Server version 1.0, consider disabling the vulnerable encryption module to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2008-2299

Produtos afetados

Citrix Access Essentials

Citrix Desktop Server

Citrix Metaframe Presentation Server

Citrix Presentation Server

Ica Basic

Secureica

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/42444 · Nota
• http://secunia.com/advisories/30271 · Aviso do Fabricante
• http://support.citrix.com/article/CTX114893 · Correção
• http://vupen.com/english/advisories/2008/1531/references · Nota
• http://securityfocus.com/bid/29233 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2299 · Nota de Segurança
• http://xforce.iss.net/xforce/xfdb/42444 · Nota
• http://securitytracker.com/id?1020026 · Correção