CVE-2011-2592 Heap-based buffer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-6...
HighCVSS 9.3
EPSS 14.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a long CSEC HTTP response header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| citrix access gateway plug-in | = 9.0 | No fix listed |
| citrix access gateway plug-in | = 9.1 | No fix listed |
| citrix access gateway plug-in | = 9.2 | No fix listed |
| citrix access gateway plug-in | = 9.3 | No fix listed |
| citrix access gateway plug-in | = 10.0 | No fix listed |
References
- 20120731 Secunia Research: Citrix Access Gateway Plug-in for Windows nsepacom ActiveX Control Buffer Overflow mailing-list
- 84433 vdb-entry
- secunia.com
- support.citrix.com vendor-advisory
- citrix-activex-control-bo(77316) vdb-entry