CVE-2011-2592

2014-06-1814:55:00

CWE-119

[email protected]

web.nvd.nist.gov

106

cve

buffer overflow

nsepa.exe

citrix access gateway

activex control

security vulnerability

8.2 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.344 Low

EPSS

Percentile

97.1%

JSON

Heap-based buffer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a long CSEC HTTP response header.

CPENameOperatorVersion
citrix:access_gateway_plug-incitrix access gateway plug-ineq9.0
citrix:access_gateway_plug-incitrix access gateway plug-ineq9.2
citrix:access_gateway_plug-incitrix access gateway plug-ineq9.1
citrix:access_gateway_plug-incitrix access gateway plug-ineq10.0
citrix:access_gateway_plug-incitrix access gateway plug-ineq9.3

CPE	Name	Operator	Version
citrix:access_gateway_plug-in	citrix access gateway plug-in	eq	9.0
citrix:access_gateway_plug-in	citrix access gateway plug-in	eq	9.2
citrix:access_gateway_plug-in	citrix access gateway plug-in	eq	9.1
citrix:access_gateway_plug-in	citrix access gateway plug-in	eq	10.0
citrix:access_gateway_plug-in	citrix access gateway plug-in	eq	9.3