PT-2008-1989 · Citrix · Citrix Access Essentials+3

Eric Detoisien · Published 2008-01-18 · Updated 2018-10-15 · CVE-2008-0356

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Citrix Presentation Server versions 4.5 and earlier Citrix Access Essentials versions 2.0 and earlier Citrix Desktop Server version 1.0

Description The issue is related to a buffer overflow in the Independent Management Architecture (IMA) service. This allows remote attackers to execute arbitrary code by sending a packet with an invalid size value to TCP port 2512 or 2513.

Recommendations For Citrix Presentation Server versions 4.5 and earlier, update to a version that fixes this issue. For Citrix Access Essentials versions 2.0 and earlier, update to a version that fixes this issue. For Citrix Desktop Server version 1.0, update to a version that fixes this issue.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-0356

Affected Products

Citrix Access Essentials

Citrix Desktop Server

Citrix Metaframe Presentation Server

Citrix Presentation Server

References · 10

• http://support.citrix.com/article/CTX114487 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-0356 · Security Note
• http://secunia.com/advisories/28508 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0172 · Note
• http://securityfocus.com/archive/1/486585/100/0/threaded · Note
• http://zerodayinitiative.com/advisories/ZDI-08-002.html · Note
• http://securityfocus.com/bid/27329 · Note
• http://kb.cert.org/vuls/id/412228 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0356 · Note
• http://securitytracker.com/id?1019231 · Note