Lucene search
HistoryNov 13, 2009 - 4:30 p.m.
CVE-2009-3936
cve-2009-3936
citrix
online plug-in
windows
mac
receiver
iphone
ica java
xenapp
xendesktop
ssl
tls
authentication bypass
vulnerability
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
9.6 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
72.7%
Unspecified vulnerability in Citrix Online Plug-in for Windows 11.0.x before 11.0.150 and 11.x before 11.2, Online Plug-in for Mac before 11.0, Receiver for iPhone before 1.0.3, and ICA Java, Mac, UNIX, and Windows Clients for XenApp and XenDesktop allows remote attackers to impersonate the SSL/TLS server and bypass authentication via a crafted certificate, a different vulnerability than CVE-2009-3555.
Affected configurations
Node
citrixonline_plug-in_for_macRange≤10.0
ORcitrixonline_plug-in_for_windowsRange≤11.2
ORcitrixonline_plug-in_for_windowsMatch11.0
ORcitrixonline_plug-in_for_windowsMatch11.1
ORcitrixreceiver_for_iphoneRange≤1.0
Related
cvelist
cvelist
CVE-2009-3936
2009-11-13 16:00:00
CVE-2009-3555
2009-11-09 17:00:00
nvd
nvd
CVE-2009-3936
2009-11-13 16:30:00
CVE-2009-3555
2009-11-09 17:30:00
prion
prion
Authentication flaw
2009-11-13 16:30:00
Cross site request forgery (csrf)
2009-11-09 17:30:00
nessus
nessus
Citrix XenApp Online Plug-in / Receiver Crafted Certificate MitM Spoofing Weakness
2009-12-01 00:00:00
SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6657)
2010-10-11 00:00:00
Fedora 12 : nss-3.12.5-8.fc12 (2010-1127)
2010-07-01 00:00:00
mozilla
mozilla
Update NSS to support TLS renegotiation indication — Mozilla
2010-03-30 00:00:00
openvas
openvas
FreeBSD Security Advisory (FreeBSD-SA-09:15.ssl.asc)
2009-12-10 00:00:00
Mandriva Update for nss MDVSA-2010:069 (nss)
2010-04-09 00:00:00
Fedora Update for nss FEDORA-2010-3905
2010-03-31 00:00:00
redhat
redhat
(RHSA-2010:0164) Moderate: openssl097a security update
2010-03-25 00:00:00
(RHSA-2010:0155) Moderate: java-1.4.2-ibm security and bug fix update
2010-03-17 00:00:00
(RHSA-2010:0165) Moderate: nss security update
2010-03-25 00:00:00
suse
suse
man-in-the-middle attack in openssl
2009-11-18 09:50:39
fedora
fedora
[SECURITY] Fedora 12 Update: gnutls-2.8.6-2.fc12
2010-06-25 18:15:19
[SECURITY] Fedora 12 Update: nss-3.12.6-1.2.fc12
2010-03-12 04:18:37
[SECURITY] Fedora 12 Update: nss-util-3.12.5-1.fc12.1
2009-12-10 04:13:15
securityvulns
securityvulns
[ MDVSA-2009:295 ] apache
2009-11-09 00:00:00
SSL data injection
2010-02-10 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 8 package openssl10 version 0.9.8l-alt1
2009-11-07 00:00:00
Security fix for the ALT Linux 6 package openssl10 version 0.9.8l-alt1
2009-11-07 00:00:00
Security fix for the ALT Linux 9 package openssl10 version 0.9.8l-alt1
2009-11-07 00:00:00
debian
debian
[SECURITY] [DSA-2141-2] New nss packages fix protocol design flaw
2011-01-05 23:20:31
[SECURITY] [DSA-2141-4] New lighttpd packages fix regression
2011-01-12 18:51:18
cve
cve
CVE-2009-3555
2009-11-09 17:30:00
seebug
seebug
ProFTPD TLS会话重协商明文数据注入漏洞
2009-12-15 00:00:00
TLS Renegotiation Vulnerability PoC Exploit
2009-12-21 00:00:00
hackerone
hackerone
LocalTapiola: Secure Client-Initiated Renegotiation
2017-12-27 15:57:52
Slack: TLS1/SSLv3 Renegotiation Vulnerability
2014-04-02 13:01:00
ubuntu
ubuntu
Apache vulnerability
2010-09-21 00:00:00
nss vulnerability
2010-06-29 00:00:00
NSS vulnerability
2010-07-23 00:00:00
fortinet
fortinet
FortiOS SSL Deep-Inspection possible Insecure Renegotiation
2017-11-03 00:00:00
veracode
veracode
Man-in-the-Middle (MitM)
2020-04-10 00:36:56
checkpoint_advisories
checkpoint_advisories
TLS Renegotiation (CVE-2009-3555)
2009-11-22 00:00:00
TLS Client Initiated Renegotiation (CVE-2009-3555)
2009-11-23 00:00:00
Preemptive Protection against TLS and SSL Spoofing Vulnerability
2010-02-09 00:00:00
cert
cert
SSL and TLS protocols renegotiation vulnerability
2009-11-11 00:00:00
packetstorm
packetstorm
TLS Renegotiation Exploit
2009-12-21 00:00:00
f5
f5
K10737 : SSL Renegotiation vulnerability - CVE-2009-3555 / VU#120541
2013-07-05 00:00:00
SOL10737 - SSL Renegotiation vulnerability - CVE-2009-3555 / VU#120541
2009-11-05 00:00:00
openssl
openssl
Vulnerability in OpenSSL CVE-2009-3555
2009-11-05 00:00:00
ubuntucve
ubuntucve
CVE-2009-3555
2009-11-09 00:00:00
freebsd_advisory
freebsd_advisory
FreeBSD-SA-09:15.ssl
2009-12-03 00:00:00
osv
osv
Apache Tomcat affected by vulnerability in TLS and SSL protocol
2022-05-02 03:46:22
exploitpack
exploitpack
TLS - Renegotiation
2009-12-21 00:00:00
oraclelinux
oraclelinux
nss security update
2010-03-25 00:00:00
openssl097a security update
2010-03-25 00:00:00
debiancve
debiancve
CVE-2009-3555
2009-11-09 17:30:00
cisco
cisco
Transport Layer Security Renegotiation Remote Man-in-the-Middle Attack Vulnerability
2009-11-05 19:53:52
Transport Layer Security Renegotiation Vulnerability
2009-11-09 13:00:00
centos
centos
nspr, nss security update
2010-03-28 15:36:50
openssl097a security update
2010-03-27 17:44:36
slackware
slackware
openssl
2009-11-16 13:42:36
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
9.6 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
72.7%
Related for CVE-2009-3936