Sign-up

ID

VAR-201507-0089


CVE

CVE-2015-5080


TITLE

Citrix NetScaler Application Delivery Controller and NetScaler Gateway of Management Interface In any shell Command execution vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2015-003889

DESCRIPTION

The Management Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before 10.1.132.8, 10.5 before Build 56.15, and 10.5.e before Build 56.1505.e allows remote authenticated users to execute arbitrary shell commands via shell metacharacters in the filter parameter to rapi/ipsec_logs. Supplementary information : CWE Vulnerability type by CWE-77: Improper Neutralization of Special Elements used in a Command ( Command injection ) Has been identified. Citrix Access Gateway is a universal SSL VPN device. An attacker may leverage this issue to execute arbitrary shell commands in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. The following products and versions are affected: Citrix Systems NetScaler ADC and NetScaler Gateway 10.1 prior to 10.1.132.8, 10.5 prior to Build 56.15, and 10.5.e prior to Build 56.1505.e

Trust: 3.06

sources: NVD: CVE-2015-5080 // JVNDB: JVNDB-2015-003889 // CNVD: CNVD-2015-04434 // CNVD: CNVD-2015-04578 // BID: 75505 // VULHUB: VHN-83041

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 1.2

sources: CNVD: CNVD-2015-04434 // CNVD: CNVD-2015-04578

AFFECTED PRODUCTS

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.5

Trust: 1.9

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.128

Trust: 1.6

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.126

Trust: 1.6

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.125

Trust: 1.6

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.127

Trust: 1.6

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.128

Trust: 1.6

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.124

Trust: 1.6

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.127

Trust: 1.6

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.126

Trust: 1.6

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.129

Trust: 1.6

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.5.51.10

Trust: 1.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.5.50.10

Trust: 1.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.5

Trust: 1.3

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1

Trust: 1.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.5e

Trust: 1.0

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.5e

Trust: 1.0

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.123

Trust: 1.0

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.123

Trust: 1.0

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.122

Trust: 1.0

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.122

Trust: 1.0

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.129

Trust: 1.0

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.120.1316.e

Trust: 1.0

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.120.1316.e

Trust: 1.0

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.124

Trust: 1.0

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.125

Trust: 1.0

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.121

Trust: 1.0

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.121

Trust: 1.0

vendor:citrixmodel:netscaler application delivery controllerscope:ltversion:10.1

Trust: 0.8

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.5.e build 56.1505.e

Trust: 0.8

vendor:citrixmodel:netscaler gatewayscope:ltversion:10.1

Trust: 0.8

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.132.8

Trust: 0.8

vendor:citrixmodel:netscaler gatewayscope:ltversion:10.5

Trust: 0.8

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.5 build 56.15

Trust: 0.8

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.132.8

Trust: 0.8

vendor:citrixmodel:netscaler application delivery controllerscope: - version: -

Trust: 0.8

vendor:citrixmodel:netscaler gatewayscope:ltversion:10.5.e

Trust: 0.8

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.5 build 56.15

Trust: 0.8

vendor:citrixmodel:netscaler application delivery controllerscope:ltversion:10.5.e

Trust: 0.8

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.5.e build 56.1505.e

Trust: 0.8

vendor:citrixmodel:netscaler gatewayscope: - version: -

Trust: 0.8

vendor:citrixmodel:netscaler application delivery controllerscope:ltversion:10.5

Trust: 0.8

vendor:citrixmodel:netscaler adc/netscaler gatewayscope: - version: -

Trust: 0.6

vendor:citrixmodel:netscaler adc/netscaler gateway buildscope:ltversion:10.556.15

Trust: 0.6

vendor:citrixmodel:netscaler adc/netscaler gateway <10.5.e build 56.1505.escope: - version: -

Trust: 0.6

vendor:citrixmodel:netscaler adc/netscaler gatewayscope:ltversion:10.1.132.8

Trust: 0.6

vendor:citrixmodel:netscaler gateway 10.5.e buildscope:eqversion:54.9009

Trust: 0.3

vendor:citrixmodel:netscaler gateway 10.5.e buildscope:eqversion:53-9010

Trust: 0.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.5-50.10

Trust: 0.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.128.8

Trust: 0.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.123.9

Trust: 0.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1.122.17

Trust: 0.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1-129.11

Trust: 0.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1-128.8003

Trust: 0.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1-126.12

Trust: 0.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1-120.1316

Trust: 0.3

vendor:citrixmodel:netscaler gatewayscope:eqversion:10.1

Trust: 0.3

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.5.51.10

Trust: 0.3

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.5.50.10

Trust: 0.3

vendor:citrixmodel:netscaler application delivery controller buildscope:eqversion:10.555.8

Trust: 0.3

vendor:citrixmodel:netscaler application delivery controller buildscope:eqversion:10.553.9

Trust: 0.3

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.128.8

Trust: 0.3

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1.122.17

Trust: 0.3

vendor:citrixmodel:netscaler gateway 10.5.e buildscope:neversion:56.1505

Trust: 0.3

vendor:citrixmodel:netscaler gateway buildscope:neversion:10.556.15

Trust: 0.3

vendor:citrixmodel:netscaler gatewayscope:neversion:10.1.132.8

Trust: 0.3

vendor:citrixmodel:netscaler application delivery controller 10.5.e buildscope:neversion:56.1505

Trust: 0.3

vendor:citrixmodel:netscaler application delivery controller buildscope:neversion:10.556.15

Trust: 0.3

vendor:citrixmodel:netscaler application delivery controllerscope:neversion:10.1.132.8

Trust: 0.3

sources: CNVD: CNVD-2015-04434 // CNVD: CNVD-2015-04578 // BID: 75505 // JVNDB: JVNDB-2015-003889 // CNNVD: CNNVD-201507-228 // NVD: CVE-2015-5080

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-5080
value: HIGH

Trust: 1.0

NVD: CVE-2015-5080
value: HIGH

Trust: 0.8

CNVD: CNVD-2015-04434
value: HIGH

Trust: 0.6

CNVD: CNVD-2015-04578
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201507-228
value: CRITICAL

Trust: 0.6

VULHUB: VHN-83041
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-5080
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-04434
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2015-04578
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-83041
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2015-04434 // CNVD: CNVD-2015-04578 // VULHUB: VHN-83041 // JVNDB: JVNDB-2015-003889 // CNNVD: CNNVD-201507-228 // NVD: CVE-2015-5080

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.1

problemtype:CWE-Other

Trust: 0.8

sources: VULHUB: VHN-83041 // JVNDB: JVNDB-2015-003889 // NVD: CVE-2015-5080

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201507-228

TYPE

Input Validation Error

Trust: 0.3

sources: BID: 75505

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-003889

PATCH
title:CTX201149url:http://support.citrix.com/article/CTX201149
Trust: 0.8
title:Patch for Citrix NetScaler ADC and NetScaler Gateway Remote Arbitrary Command Execution Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/60712
Trust: 0.6
title:Patch for Citrix NetScaler ADC and NetScaler Gateway Remote Arbitrary Shell Command Execution Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/60934
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-04434 // 
            
            
            
            CNVD: CNVD-2015-04578 // 
            
            
            
            JVNDB: JVNDB-2015-003889

EXTERNAL IDS
db:NVDid:CVE-2015-5080
Trust: 4.0
db:BIDid:75505
Trust: 2.0
db:SECTRACKid:1032762
Trust: 1.7
db:JVNDBid:JVNDB-2015-003889
Trust: 0.8
db:CNNVDid:CNNVD-201507-228
Trust: 0.7
db:CNVDid:CNVD-2015-04434
Trust: 0.6
db:CNVDid:CNVD-2015-04578
Trust: 0.6
db:VULHUBid:VHN-83041
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-04434 // 
            
            
            
            CNVD: CNVD-2015-04578 // 
            
            
            
            VULHUB: VHN-83041 // 
            
            
            
            BID: 75505 // 
            
            
            
            JVNDB: JVNDB-2015-003889 // 
            
            
            
            CNNVD: CNNVD-201507-228 // 
            
            
            
            NVD: CVE-2015-5080

REFERENCES
url:http://support.citrix.com/article/ctx201149
Trust: 3.2
url:http://www.securityfocus.com/bid/75505
Trust: 1.7
url:http://security-assessment.com/files/documents/advisory/citrix-netscaler-final.pdf
Trust: 1.7
url:http://www.securitytracker.com/id/1032762
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5080
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5080
Trust: 0.8
url:https://www.citrix.com/products/netscaler-application-delivery-controller/overview.html
Trust: 0.3
url:https://www.citrix.com/products/netscaler-gateway/overview.html
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2015-04434 // 
            
            
            
            CNVD: CNVD-2015-04578 // 
            
            
            
            VULHUB: VHN-83041 // 
            
            
            
            BID: 75505 // 
            
            
            
            JVNDB: JVNDB-2015-003889 // 
            
            
            
            CNNVD: CNNVD-201507-228 // 
            
            
            
            NVD: CVE-2015-5080

CREDITS
Daniel Jensen of Security Assessment
Trust: 0.9
sources:
            
            
            BID: 75505 // 
            
            
            
            CNNVD: CNNVD-201507-228

SOURCES
db:CNVDid:CNVD-2015-04434
db:CNVDid:CNVD-2015-04578
db:VULHUBid:VHN-83041
db:BIDid:75505
db:JVNDBid:JVNDB-2015-003889
db:CNNVDid:CNNVD-201507-228
db:NVDid:CVE-2015-5080

LAST UPDATE DATE
2024-11-23T22:59:32.540000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-04434date:2015-07-13T00:00:00
db:CNVDid:CNVD-2015-04578date:2015-07-16T00:00:00
db:VULHUBid:VHN-83041date:2016-12-07T00:00:00
db:BIDid:75505date:2015-06-30T00:00:00
db:JVNDBid:JVNDB-2015-003889date:2015-07-23T00:00:00
db:CNNVDid:CNNVD-201507-228date:2015-07-17T00:00:00
db:NVDid:CVE-2015-5080date:2024-11-21T02:32:17.817

SOURCES RELEASE DATE
db:CNVDid:CNVD-2015-04434date:2015-07-13T00:00:00
db:CNVDid:CNVD-2015-04578date:2015-07-16T00:00:00
db:VULHUBid:VHN-83041date:2015-07-16T00:00:00
db:BIDid:75505date:2015-06-30T00:00:00
db:JVNDBid:JVNDB-2015-003889date:2015-07-23T00:00:00
db:CNNVDid:CNNVD-201507-228date:2015-06-30T00:00:00
db:NVDid:CVE-2015-5080date:2015-07-16T14:59:05.933