PT-2015-6771 · Citrix · Citrix Netscaler Application Delivery Controller+1

Publicado 2015-07-16 · Atualizado 2016-12-07 · CVE-2015-5080

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway versions 10.1 before 10.1.132.8 Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway versions 10.5 before Build 56.15 Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway versions 10.5.e before Build 56.1505.e

Description The issue allows remote authenticated users to execute arbitrary shell commands via shell metacharacters in the filter parameter to the "rapi/ipsec logs" endpoint.

Recommendations For versions 10.1 before 10.1.132.8, update to version 10.1.132.8 or later. For versions 10.5 before Build 56.15, update to Build 56.15 or later. For versions 10.5.e before Build 56.1505.e, update to Build 56.1505.e or later.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2015-5080

Produtos afetados

Citrix Netscaler Application Delivery Controller

Netscaler Gateway

Referências · 5

• http://securitytracker.com/id/1032762 · Nota
• http://security-assessment.com/files/documents/advisory/Citrix-Netscaler-Final.pdf · Nota
• http://support.citrix.com/article/CTX201149 · Nota
• http://securityfocus.com/bid/75505 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5080 · Nota de Segurança