PT-2016-7623 · Citrix · Citrix Netscaler Adc

Published 2016-10-28 · Updated 2017-07-29 · CVE-2016-9028

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Citrix NetScaler ADC versions prior to 10.1 135.8 Citrix NetScaler ADC versions prior to 10.5 61.11 Citrix NetScaler ADC versions prior to 11.0 65.31/65.35F Citrix NetScaler ADC versions prior to 11.1 47.14

Description The issue allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of the Host header.

Recommendations For versions prior to 10.1 135.8, update to version 10.1 135.8 or later. For versions prior to 10.5 61.11, update to version 10.5 61.11 or later. For versions prior to 11.0 65.31/65.35F, update to version 11.0 65.31/65.35F or later. For versions prior to 11.1 47.14, update to version 11.1 47.14 or later.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2016-9028

Affected Products

Citrix Netscaler Adc

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-9028 · Security Note
• https://support.citrix.com/article/CTX218361 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9028 · Vendor Advisory
• http://securityfocus.com/bid/93947 · Note
• http://securitytracker.com/id/1037175 · Note