Details of VAR-201107-0298

ID

VAR-201107-0298

CVE

CVE-2011-2883

TITLE

Citrix Access Gateway Enterprise of nsepa.ocx of NSEPA.NsepaCtrl.1 ActiveX Vulnerability in arbitrary code execution in control

Trust: 0.8

sources: JVNDB: JVNDB-2011-004817

DESCRIPTION

The NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 attempts to validate signed DLLs by checking the certificate subject, not the signature, which allows man-in-the-middle attackers to execute arbitrary code via HTTP header data referencing a DLL that was signed with a crafted certificate. Citrix Access Gateway is a universal SSL VPN device. Attackers may exploit these issues by enticing an unsuspecting victim to view a malicious webpage. Citrix Access Gateway Plug-in versions prior to 8.1-67.7, 9.0-70.5, and 9.1-96.4 are vulnerable; other versions may also be affected

Trust: 2.52

sources: NVD: CVE-2011-2883 // JVNDB: JVNDB-2011-004817 // CNVD: CNVD-2011-3493 // BID: 48676 // VULHUB: VHN-50828

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2011-3493

AFFECTED PRODUCTS

vendor:	citrix	model:	access gateway	scope:	eq	version:	9.0	Trust: 1.6
vendor:	citrix	model:	access gateway	scope:	eq	version:	8.1	Trust: 1.6
vendor:	citrix	model:	access gateway	scope:	eq	version:	9.1	Trust: 1.6
vendor:	citrix	model:	access gateway	scope:	eq	version:	9.0-70.5	Trust: 0.8
vendor:	citrix	model:	access gateway	scope:	lt	version:	9.1	Trust: 0.8
vendor:	citrix	model:	access gateway	scope:	eq	version:	9.1-96.4	Trust: 0.8
vendor:	citrix	model:	access gateway	scope:	lt	version:	8.1	Trust: 0.8
vendor:	citrix	model:	access gateway	scope:	lt	version:	9.0	Trust: 0.8
vendor:	citrix	model:	access gateway	scope:	eq	version:	enterprise edition 8.1-67.7	Trust: 0.8
vendor:	citrix	model:	access gateway	scope:	lt	version:	8.1-67.7	Trust: 0.6
vendor:	citrix	model:	access gateway	scope:	lt	version:	9.0-70.5	Trust: 0.6
vendor:	citrix	model:	access gateway	scope:	lt	version:	9.1-96.4	Trust: 0.6

sources: CNVD: CNVD-2011-3493 // JVNDB: JVNDB-2011-004817 // CNNVD: CNNVD-201107-363 // NVD: CVE-2011-2883

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2011-2883
value:	HIGH
Trust: 1.0
NVD:	CVE-2011-2883
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201107-363
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-50828
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2011-2883
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-50828
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-50828 // JVNDB: JVNDB-2011-004817 // CNNVD: CNNVD-201107-363 // NVD: CVE-2011-2883

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-50828 // JVNDB: JVNDB-2011-004817 // NVD: CVE-2011-2883

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201107-207 // CNNVD: CNNVD-201107-363

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-201107-207

CONFIGURATIONS

sources: JVNDB: JVNDB-2011-004817

PATCH

title:	NetScaler Access Gateway	url:	http://www.citrix.com/English/ps2/products/product.asp?contentID=15005&ntref=prod_biz	Trust: 0.8
title:	Patch for Citrix Gateway ActiveX Control Code Execution Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/4990	Trust: 0.6

sources: CNVD: CNVD-2011-3493 // JVNDB: JVNDB-2011-004817

EXTERNAL IDS

db:	NVD	id:	CVE-2011-2883	Trust: 3.4
db:	BID	id:	48676	Trust: 1.5
db:	JVNDB	id:	JVNDB-2011-004817	Trust: 0.8
db:	CNNVD	id:	CNNVD-201107-363	Trust: 0.7
db:	CNVD	id:	CNVD-2011-3493	Trust: 0.6
db:	CNNVD	id:	CNNVD-201107-207	Trust: 0.6
db:	IDEFENSE	id:	20110714 CITRIX ACCESS GATEWAY ACTIVEX ARBITRARY LIBARY LOADING VULNERABILITY	Trust: 0.6
db:	VULHUB	id:	VHN-50828	Trust: 0.1

sources: CNVD: CNVD-2011-3493 // VULHUB: VHN-50828 // BID: 48676 // JVNDB: JVNDB-2011-004817 // CNNVD: CNNVD-201107-207 // CNNVD: CNNVD-201107-363 // NVD: CVE-2011-2883

REFERENCES

url:	http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=928	Trust: 2.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2883	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-2883	Trust: 0.8
url:	http://www.securityfocus.com/bid/48676/	Trust: 0.6
url:	http://www.securityfocus.com/bid/48676	Trust: 0.6
url:	http://support.citrix.com/article/ctx129902	Trust: 0.3
url:	http://www.citrix.com/	Trust: 0.3
url:	http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=929	Trust: 0.3

sources: CNVD: CNVD-2011-3493 // VULHUB: VHN-50828 // BID: 48676 // JVNDB: JVNDB-2011-004817 // CNNVD: CNNVD-201107-207 // CNNVD: CNNVD-201107-363 // NVD: CVE-2011-2883

CREDITS

Joshua J. Drake and Michal Trojnara

Trust: 0.9

sources: BID: 48676 // CNNVD: CNNVD-201107-207

SOURCES

db:	CNVD	id:	CNVD-2011-3493
db:	VULHUB	id:	VHN-50828
db:	BID	id:	48676
db:	JVNDB	id:	JVNDB-2011-004817
db:	CNNVD	id:	CNNVD-201107-207
db:	CNNVD	id:	CNNVD-201107-363
db:	NVD	id:	CVE-2011-2883

LAST UPDATE DATE

2024-08-14T14:21:36.644000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2011-3493	date:	2011-09-05T00:00:00
db:	VULHUB	id:	VHN-50828	date:	2011-07-22T00:00:00
db:	BID	id:	48676	date:	2011-08-31T07:30:00
db:	JVNDB	id:	JVNDB-2011-004817	date:	2012-03-27T00:00:00
db:	CNNVD	id:	CNNVD-201107-207	date:	2011-07-18T00:00:00
db:	CNNVD	id:	CNNVD-201107-363	date:	2011-07-22T00:00:00
db:	NVD	id:	CVE-2011-2883	date:	2011-07-22T04:00:00

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2011-3493	date:	2011-09-05T00:00:00
db:	VULHUB	id:	VHN-50828	date:	2011-07-21T00:00:00
db:	BID	id:	48676	date:	2011-07-14T00:00:00
db:	JVNDB	id:	JVNDB-2011-004817	date:	2012-03-27T00:00:00
db:	CNNVD	id:	CNNVD-201107-207	date:	1900-01-01T00:00:00
db:	CNNVD	id:	CNNVD-201107-363	date:	2011-07-22T00:00:00
db:	NVD	id:	CVE-2011-2883	date:	2011-07-21T23:55:04.317