PT-2015-6771 · Citrix · Citrix Netscaler Application Delivery Controller+1

Published 2015-07-16 · Updated 2016-12-07 · CVE-2015-5080

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway versions 10.1 before 10.1.132.8 Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway versions 10.5 before Build 56.15 Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway versions 10.5.e before Build 56.1505.e

Description The issue allows remote authenticated users to execute arbitrary shell commands via shell metacharacters in the filter parameter to the "rapi/ipsec logs" endpoint.

Recommendations For versions 10.1 before 10.1.132.8, update to version 10.1.132.8 or later. For versions 10.5 before Build 56.15, update to Build 56.15 or later. For versions 10.5.e before Build 56.1505.e, update to Build 56.1505.e or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2015-5080

Affected Products

Citrix Netscaler Application Delivery Controller

Netscaler Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-5080 · Security Note
• http://securitytracker.com/id/1032762 · Note
• http://security-assessment.com/files/documents/advisory/Citrix-Netscaler-Final.pdf · Note
• http://support.citrix.com/article/CTX201149 · Note
• http://securityfocus.com/bid/75505 · Note