CVE-2008-0356

Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://support.citrix.com/article/CTX114487	Patch
http://zerodayinitiative.com/advisories/ZDI-08-002.html
http://secunia.com/advisories/28508	Vendor Advisory
http://www.kb.cert.org/vuls/id/412228	US Government Resource
http://www.securityfocus.com/bid/27329
http://www.securitytracker.com/id?1019231
http://www.vupen.com/english/advisories/2008/0172
http://www.securityfocus.com/archive/1/486585/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:citrix:desktop_server:1.0:::::::*
	cpe:2.3:a:citrix:presentation_server::::::::
	cpe:2.3:a:citrix:access_essentials::::::::
	cpe:2.3:a:citrix:metaframe_presentation_server::::::::

Information

Published : 2008-01-18 14:00

Updated : 2018-10-15 14:59

NVD link : CVE-2008-0356

Mitre link : CVE-2008-0356

JSON object : View

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Advertisement

Products Affected

citrix

presentation_server
access_essentials
desktop_server
metaframe_presentation_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://support.citrix.com/article/CTX114487", "name": "http://support.citrix.com/article/CTX114487", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://zerodayinitiative.com/advisories/ZDI-08-002.html", "name": "http://zerodayinitiative.com/advisories/ZDI-08-002.html", "tags": [], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/28508", "name": "28508", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.kb.cert.org/vuls/id/412228", "name": "VU#412228", "tags": ["US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.securityfocus.com/bid/27329", "name": "27329", "tags": [], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id?1019231", "name": "1019231", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.vupen.com/english/advisories/2008/0172", "name": "ADV-2008-0172", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/486585/100/0/threaded", "name": "20080117 ZDI-08-002: Citrix Presentation Server IMA Service Heap Overflow Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-119"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-0356", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2008-01-18T22:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:citrix:desktop_server:1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:citrix:presentation_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:citrix:access_essentials:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0"}, {"cpe23Uri": "cpe:2.3:a:citrix:metaframe_presentation_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "4.5"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-15T21:59Z"}