Citrix EdgeSight Remote Code Execution Vulnerability

Bugtraq ID:	48385
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jun 22 2011 12:00AM
Updated:	Jun 28 2011 09:00AM
Credit:	AbdulAziz Hariri via ZDI
Vulnerable:	Citrix EdgeSight for Load Testing 3.8 Citrix EdgeSight for Active Application Monitoring 5.3 SP1
Not Vulnerable:	Citrix EdgeSight for Load Testing 3.8.1 Citrix EdgeSight for Active Application Monitoring 5.3 SP2

Citrix EdgeSight Remote Code Execution Vulnerability

Citrix EdgeSight is prone to a remote code-execution vulnerability.

Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the SYSTEM user.

The following products are affected:

Citrix EdgeSight for Active Application Monitoring
Citrix EdgeSight for Load Testing

Citrix EdgeSight Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Citrix EdgeSight Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

Citrix EdgeSight Remote Code Execution Vulnerability

References:

• Citrix Homepage (Citrix)
  
• Vulnerability in Citrix EdgeSight for Active Application Monitoring and Citrix E (Citrix)
  
• Citrix EdgeSight Launcher Service Remote Code Execution Vulnerability (Zero Day Initiative)