PT-2009-6152 · Citrix · Citrix Receiver For Iphone+3

Publicado 2009-11-13 · Atualizado 2017-08-17 · CVE-2009-3936

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Citrix Online Plug-in for Windows versions 11.0.x through 11.0.149 Citrix Online Plug-in for Windows versions 11.x through 11.1 Citrix Online Plug-in for Mac version 11.0 and earlier Citrix Receiver for iPhone versions prior to 1.0.3 ICA Java, Mac, UNIX, and Windows Clients for XenApp and XenDesktop (affected versions not specified)

Description The issue allows remote attackers to impersonate the SSL/TLS server and bypass authentication via a crafted certificate.

Recommendations For Citrix Online Plug-in for Windows versions 11.0.x through 11.0.149, update to version 11.0.150 or later. For Citrix Online Plug-in for Windows versions 11.x through 11.1, update to version 11.2 or later. For Citrix Online Plug-in for Mac version 11.0 and earlier, update to a version later than 11.0. For Citrix Receiver for iPhone versions prior to 1.0.3, update to version 1.0.3 or later. For ICA Java, Mac, UNIX, and Windows Clients for XenApp and XenDesktop, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-3936

Produtos afetados

Citrix Online Plug-In For Mac

Citrix Online Plug-In For Windows

Citrix Receiver For Iphone

Ica Java

Referências · 7

• http://support.citrix.com/article/CTX123248 · Aviso do Fabricante
• http://securitytracker.com/id?1023168 · Nota
• http://vupen.com/english/advisories/2009/3206 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54213 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3936 · Nota de Segurança
• http://securityfocus.com/bid/37073 · Nota
• http://secunia.com/advisories/37319 · Aviso do Fabricante