PT-2007-4925 · Citrix · Citrix Access Gateway Standard Edition+2

Published 2007-07-25 · Updated 2018-10-15 · CVE-2007-3679

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Citrix Access Gateway Standard Edition versions prior to 4.5.5 Citrix Access Gateway Advanced Edition versions prior to 4.5 HF1 Citrix EPA ActiveX control version prior to 4.5.0.0

Description The issue allows remote attackers to download and execute arbitrary programs onto a client system. This is due to a problem in the Citrix EPA ActiveX control, also known as the endpoint checking control or CCAOControl Object, which is part of npCtxCAO.dll.

Recommendations For Citrix Access Gateway Standard Edition versions prior to 4.5.5, update to version 4.5.5 or later. For Citrix Access Gateway Advanced Edition versions prior to 4.5 HF1, update to version 4.5 HF1 or later. For the Citrix EPA ActiveX control version prior to 4.5.0.0, update to version 4.5.0.0 or later.

Fix

Related Identifiers

CVE-2007-3679

Affected Products

Citrix Access Gateway Advanced Edition

Citrix Access Gateway Standard Edition

Citrix Epa Activex Control

References · 13

• http://securityfocus.com/bid/24975 · Patch
• http://secunia.com/advisories/26143 · Vendor Advisory
• http://support.citrix.com/article/CTX114028 · Patch
• http://support.citrix.com/article/CTX113815 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-3679 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3679 · Note
• http://securityreason.com/securityalert/2916 · Note
• http://osvdb.org/37845 · Note
• http://securityfocus.com/bid/24865 · Note
• http://securityfocus.com/archive/1/474204/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35511 · Note
• http://vupen.com/english/advisories/2007/2583 · Note
• http://symantec.com/content/en/us/enterprise/research/SYMSA-2007-006.txt · Note