Vulnerability CVE-2006-5821
Published: 2006-11-10   Modified: 2012-02-12

Description:
Heap-based buffer overflow in the IMA_SECURE_DecryptData1 function in ImaSystem.dll for Citrix MetaFrame XP 1.0 and 2.0, and Presentation Server 3.0 and 4.0, allows remote attackers to execute arbitrary code via requests to the Independent Management Architecture (IMA) service (ImaSrv.exe) with invalid size values that trigger the overflow during decryption.

Type:

CWE-Other

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Citrix -> Metaframe 
Citrix -> Metaframe presentation server 

 References:
http://securitytracker.com/id?1017205
http://support.citrix.com/article/CTX111186
http://www.securityfocus.com/archive/1/451337/100/100/threaded
http://www.securityfocus.com/bid/20986
http://www.vupen.com/english/advisories/2006/4429
http://www.zerodayinitiative.com/advisories/ZDI-06-038.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/30148
Copyright 2024, cxsecurity.com

 

Back to Top