PT-2001-2062 · Citrix · Citrix Metaframe

Published 2001-11-21 · Updated 2017-12-19 · CVE-2001-0908

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CITRIX Metaframe version 1.8

Description The issue allows clients to spoof their public IP address by logging the Client Address provided by the client instead of obtaining it from packet headers. This can be exploited through Network Address Translation (NAT).

Recommendations For CITRIX Metaframe version 1.8, consider implementing a mechanism to obtain the client's IP address from packet headers instead of relying on the client-provided address to prevent IP spoofing.

Fix

Related Identifiers

CVE-2001-0908

Affected Products

Citrix Metaframe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-0908 · Security Note
• http://securityfocus.com/bid/3566 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0908 · Note
• http://marc.info/?l=bugtraq&m=100638693315933&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7538 · Note