Details of VAR-200609-0296

ID

VAR-200609-0296

CVE

CVE-2006-4846

TITLE

Citrix Access Gateway LDAP authentication bypass

Trust: 0.8

sources: CERT/CC: VU#658620

DESCRIPTION

Unspecified vulnerability in Citrix Access Gateway with Advanced Access Control (AAC) 4.2 before 20060914, when AAC is configured to use LDAP authentication, allows remote attackers to bypass authentication via unknown vectors. Citrix Access Gateway is prone to an authentication-bypass vulnerability. Citrix Access Gateway, a general-purpose SSL VPN device, provides secure and always-on single-point access support for information resources. ---------------------------------------------------------------------- Want to work within IT-Security? Secunia is expanding its team of highly skilled security experts. We will help with relocation and obtaining a work permit. The vulnerability is caused due to an error in the LDAP authentication. Other versions may also be affected. SOLUTION: Apply hotfix AAC420W004. http://support.citrix.com/article/CTX110439 PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://support.citrix.com/article/CTX110950 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.79

sources: NVD: CVE-2006-4846 // CERT/CC: VU#658620 // JVNDB: JVNDB-2006-001268 // BID: 20066 // VULHUB: VHN-20954 // PACKETSTORM: 50123

AFFECTED PRODUCTS

vendor:	citrix	model:	access gateway	scope:	eq	version:	4.2	Trust: 1.6
vendor:	citrix	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	citrix	model:	access gateway	scope:	eq	version:	20060914	Trust: 0.8
vendor:	citrix	model:	access gateway	scope:	lt	version:	4.2	Trust: 0.8
vendor:	citrix	model:	access gateway aac	scope:	eq	version:	4.2	Trust: 0.3

sources: CERT/CC: VU#658620 // BID: 20066 // JVNDB: JVNDB-2006-001268 // CNNVD: CNNVD-200609-292 // NVD: CVE-2006-4846

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2006-4846
value:	MEDIUM
Trust: 1.0
CARNEGIE MELLON:	VU#658620
value:	1.15
Trust: 0.8
NVD:	CVE-2006-4846
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-200609-292
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-20954
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2006-4846
severity:	MEDIUM
baseScore:	5.1
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	4.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-20954
severity:	MEDIUM
baseScore:	5.1
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	4.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CERT/CC: VU#658620 // VULHUB: VHN-20954 // JVNDB: JVNDB-2006-001268 // CNNVD: CNNVD-200609-292 // NVD: CVE-2006-4846

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-4846

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200609-292

TYPE

Design Error

Trust: 0.9

sources: BID: 20066 // CNNVD: CNNVD-200609-292

CONFIGURATIONS

sources: JVNDB: JVNDB-2006-001268

PATCH

title:	CTX110950	url:	http://support.citrix.com/article/CTX110950	Trust: 0.8
title:	CTX110439	url:	http://support.citrix.com/article/CTX110439	Trust: 0.8

sources: JVNDB: JVNDB-2006-001268

EXTERNAL IDS

db:	CERT/CC	id:	VU#658620	Trust: 3.3
db:	SECUNIA	id:	21941	Trust: 2.6
db:	SECTRACK	id:	1016874	Trust: 2.5
db:	NVD	id:	CVE-2006-4846	Trust: 2.5
db:	BID	id:	20066	Trust: 2.0
db:	VUPEN	id:	ADV-2006-3643	Trust: 1.7
db:	OSVDB	id:	28938	Trust: 1.7
db:	JVNDB	id:	JVNDB-2006-001268	Trust: 0.8
db:	CNNVD	id:	CNNVD-200609-292	Trust: 0.7
db:	XF	id:	28990	Trust: 0.6
db:	VULHUB	id:	VHN-20954	Trust: 0.1
db:	PACKETSTORM	id:	50123	Trust: 0.1

sources: CERT/CC: VU#658620 // VULHUB: VHN-20954 // BID: 20066 // JVNDB: JVNDB-2006-001268 // PACKETSTORM: 50123 // CNNVD: CNNVD-200609-292 // NVD: CVE-2006-4846

REFERENCES

url:	http://www.kb.cert.org/vuls/id/658620	Trust: 2.5
url:	http://support.citrix.com/article/ctx110439	Trust: 2.1
url:	http://support.citrix.com/article/ctx110950	Trust: 2.1
url:	http://www.securityfocus.com/bid/20066	Trust: 1.7
url:	http://www.osvdb.org/28938	Trust: 1.7
url:	http://securitytracker.com/id?1016874	Trust: 1.7
url:	http://secunia.com/advisories/21941	Trust: 1.7
url:	http://www.vupen.com/english/advisories/2006/3643	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/28990	Trust: 1.1
url:	http://secunia.com/advisories/21941/	Trust: 0.9
url:	http://support.citrix.com/article/ctx110950	Trust: 0.8
url:	http://www.citrix.com/english/ps2/products/product.asp?contentid=15005	Trust: 0.8
url:	http://securitytracker.com/alerts/2006/sep/1016874.html	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-4846	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-4846	Trust: 0.8
url:	http://www.frsirt.com/english/advisories/2006/3643	Trust: 0.6
url:	http://xforce.iss.net/xforce/xfdb/28990	Trust: 0.6
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/product/6168/	Trust: 0.1
url:	http://secunia.com/quality_assurance_analyst/	Trust: 0.1
url:	http://secunia.com/hardcore_disassembler_and_reverse_engineer/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/web_application_security_specialist/	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1

sources: CERT/CC: VU#658620 // VULHUB: VHN-20954 // BID: 20066 // JVNDB: JVNDB-2006-001268 // PACKETSTORM: 50123 // CNNVD: CNNVD-200609-292 // NVD: CVE-2006-4846

CREDITS

Citrix※http://www.citrix.com/

Trust: 0.6

sources: CNNVD: CNNVD-200609-292

SOURCES

db:	CERT/CC	id:	VU#658620
db:	VULHUB	id:	VHN-20954
db:	BID	id:	20066
db:	JVNDB	id:	JVNDB-2006-001268
db:	PACKETSTORM	id:	50123
db:	CNNVD	id:	CNNVD-200609-292
db:	NVD	id:	CVE-2006-4846

LAST UPDATE DATE

2024-08-14T15:35:55.495000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#658620	date:	2007-01-29T00:00:00
db:	VULHUB	id:	VHN-20954	date:	2017-07-20T00:00:00
db:	BID	id:	20066	date:	2006-09-18T23:21:00
db:	JVNDB	id:	JVNDB-2006-001268	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-200609-292	date:	2006-09-28T00:00:00
db:	NVD	id:	CVE-2006-4846	date:	2017-07-20T01:33:21.243

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#658620	date:	2006-11-10T00:00:00
db:	VULHUB	id:	VHN-20954	date:	2006-09-19T00:00:00
db:	BID	id:	20066	date:	2006-09-16T00:00:00
db:	JVNDB	id:	JVNDB-2006-001268	date:	2012-06-26T00:00:00
db:	PACKETSTORM	id:	50123	date:	2006-09-21T23:56:25
db:	CNNVD	id:	CNNVD-200609-292	date:	2006-09-18T00:00:00
db:	NVD	id:	CVE-2006-4846	date:	2006-09-19T01:07:00