PT-2009-6152 · Citrix · Citrix Receiver For Iphone+3

Published 2009-11-13 · Updated 2017-08-17 · CVE-2009-3936

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Citrix Online Plug-in for Windows versions 11.0.x through 11.0.149 Citrix Online Plug-in for Windows versions 11.x through 11.1 Citrix Online Plug-in for Mac version 11.0 and earlier Citrix Receiver for iPhone versions prior to 1.0.3 ICA Java, Mac, UNIX, and Windows Clients for XenApp and XenDesktop (affected versions not specified)

Description The issue allows remote attackers to impersonate the SSL/TLS server and bypass authentication via a crafted certificate.

Recommendations For Citrix Online Plug-in for Windows versions 11.0.x through 11.0.149, update to version 11.0.150 or later. For Citrix Online Plug-in for Windows versions 11.x through 11.1, update to version 11.2 or later. For Citrix Online Plug-in for Mac version 11.0 and earlier, update to a version later than 11.0. For Citrix Receiver for iPhone versions prior to 1.0.3, update to version 1.0.3 or later. For ICA Java, Mac, UNIX, and Windows Clients for XenApp and XenDesktop, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-3936

Affected Products

Citrix Online Plug-In For Mac

Citrix Online Plug-In For Windows

Citrix Receiver For Iphone

Ica Java

References · 7

• http://support.citrix.com/article/CTX123248 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3936 · Security Note
• http://secunia.com/advisories/37319 · Vendor Advisory
• http://securitytracker.com/id?1023168 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54213 · Note
• http://securityfocus.com/bid/37073 · Note