Secunia Logo  


Secunia PSI WorldMap
 
Citrix Access Gateway Multiple Vulnerabilities
Secunia Advisory: SA26143
Release Date: 2007-07-20
Last Update: 2007-11-06
Popularity: 13,425 views

Critical:
Highly critical
Impact: Cross Site Scripting
Exposure of sensitive information
System access
Where: From remote
Solution Status: Vendor Patch

Software:Citrix Access Gateway 4.x

Secunia CVSS-2 Score: Available in Secunia business solutions

Subscribe: Instant alerts on relevant vulnerabilities


Advisory Content (Page 2 of 3)[ 1 ] [ 2 ] [ 3 ]

Solution:
Apply hotfix and update firmware to version 4.5.5.

Access Gateway Standard Edition 4.5:
http://support.citrix.com/article/CTX114028

Access Gateway Advanced Edition 4.5:
http://support.citrix.com/article/CTX112803

The vendor also recommends removing the following components from client devices:

VPN ActiveX components:
* Net6Helper.DLL (Friendly name: Net6Launcher Class, version number up to and including 4.5.2)

EPA Components (ActiveX):
* npCtxCAO.dll (Friendly name: CCAOControl Object, version number up to 4,5,0,0)

EPA Components (Firefox plugin):
* npCtxCAO.dll (Friendly name: Citrix Endpoint Analysis Client, present in two locations)

Provided and/or discovered by:
1) Martin O’Neal, Corsaire.
2) Michael White, Symantec.
3) The vendor credits Paul Johnston.

Changelog:
2007-07-23: Updated "Description" section. Added CVE reference and additional link from Symantec.
2007-07-27: Added CVE reference.
2007-10-23: Added link to "Original Advisory" section.
2007-11-06: Added CVE reference.

Original Advisory:
Citrix:
http://support.citrix.com/article/CTX113814
http://support.citrix.com/article/CTX113815
http://support.citrix.com/article/CTX113816
http://support.citrix.com/article/CTX113817

Symantec:
http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-006.txt

Corsaire:
http://research.corsaire.com/advisories/c060905-001.txt

Change Page:
[ 1 ] [ 2 ] [ 3 ]



Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.

Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  
Latest Advisories

9th Nov, 2009
New advisories: 6
New vulnerabilities: 23
Updated advisories: 66

Not // 230 views
Debian update for pidgin
Less // 268 views
Debian update for linux-2.6
Less // 227 views
Debian update for drupal6
Highly // 258 views
Debian update for nspr

6th Nov, 2009
New advisories: 17
New vulnerabilities: 65
Updated advisories: 21

Less // 450 views
Debian update for linux-2.6.24
Less // 433 views
Debian update for linux-2.6
Moderately // 392 views
Gentoo update for horde

Solutions | More...  


Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.

Most Popular - 3 Hours

1. Sun Java JDK / JRE Multiple Vulnerabilities // 51 views
2. Internet Explorer Charset Inheritance Cross-Site Scripting Vulnerability // 35 views
3. Mozilla Firefox Multiple Vulnerabilities // 31 views
4. Debian update for nspr // 24 views
5. Sun Solaris mod_perl Two Vulnerabilities // 24 views
6. Linux Kernel 2.4 Multiple Vulnerabilities // 23 views
7. Debian update for drupal6 // 18 views
8. Debian update for linux-2.6 // 18 views
9. Google Chrome Two Vulnerabilities // 17 views
10. Adobe Flash Player Multiple Vulnerabilities // 16 views