PT-2016-7623 · Citrix · Citrix Netscaler Adc

Publicado 2016-10-28 · Atualizado 2017-07-29 · CVE-2016-9028

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Citrix NetScaler ADC versions prior to 10.1 135.8 Citrix NetScaler ADC versions prior to 10.5 61.11 Citrix NetScaler ADC versions prior to 11.0 65.31/65.35F Citrix NetScaler ADC versions prior to 11.1 47.14

Description The issue allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of the Host header.

Recommendations For versions prior to 10.1 135.8, update to version 10.1 135.8 or later. For versions prior to 10.5 61.11, update to version 10.5 61.11 or later. For versions prior to 11.0 65.31/65.35F, update to version 11.0 65.31/65.35F or later. For versions prior to 11.1 47.14, update to version 11.1 47.14 or later.

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

CVE-2016-9028

Produtos afetados

Citrix Netscaler Adc

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-9028 · Nota de Segurança
• http://securityfocus.com/bid/93947 · Nota
• https://support.citrix.com/article/CTX218361 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-9028 · Aviso do Fabricante
• http://securitytracker.com/id/1037175 · Nota