Multiple Citrix Products Unspecified SSL/TLS Certificate Spoofing Vulnerability

Bugtraq ID:	37073
Class:	Design Error
CVE:	CVE-2009-3936
Remote:	Yes
Local:	No
Published:	Nov 09 2009 12:00AM
Updated:	Nov 19 2009 10:05PM
Credit:	Citrix
Vulnerable:	Citrix Receiver for iPhone 1.0 Citrix Online Plug-in for Windows 11.0 Citrix Online Plug-in for Mac 0 Citrix ICA Client for XenDesktop 0 Citrix ICA Client for XenApp 0
Not Vulnerable:	Citrix Receiver for iPhone 1.0.3 Citrix Online Plug-in for Windows 11.0.150 Citrix Online Plug-in for Windows 11.2 Citrix Online Plug-in for Mac 11.0

Multiple Citrix Products Unspecified SSL/TLS Certificate Spoofing Vulnerability

Multiple Citrix products are prone to a vulnerability that may allow attackers to spoof an SSL or TLS endpoint.

Attackers may exploit this vulnerability to impersonate a legitimate server to bypass intended authentication protections. Other attacks may be possible.

The following products are affected:

Citrix Online Plug-in for Windows prior to 11.0.150 and 11.2
Citrix Online Plug-in for Mac prior to 11.0
Citrix Receiver for iPhone prior to 1.0.3
ICA Client for XenApp
ICA Client for XenDesktop

Multiple Citrix Products Unspecified SSL/TLS Certificate Spoofing Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Citrix Products Unspecified SSL/TLS Certificate Spoofing Vulnerability

Solution:
Updates are available. Please see the references for details.

Multiple Citrix Products Unspecified SSL/TLS Certificate Spoofing Vulnerability

References:

• Citrix Homepage (Citrix)
  
• Vulnerability in Citrix Online Plug-ins and ICA Clients Could Result in SSL/TLS (Citrix)