bugtraq - Command injection vulnerability in Citrix NITRO SDK xen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 19 Mar 2015 17:14:20 +0100
From: "Securify B.V." <lists@...urify.nl>
To: bugtraq@...urityfocus.com
Subject: Command injection vulnerability in Citrix NITRO SDK xen_hotfix page

------------------------------------------------------------------------
Command injection vulnerability in Citrix NITRO SDK xen_hotfix page
------------------------------------------------------------------------
Han Sahin, August 2014

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
Securify discovered a command injection vulnerability in xen_hotfix page
of the NITRO SDK. The attacker-supplied command is executed with
elevated privileges (nsroot). This issue can be used to compromise of
the entire Citrix SDX appliance and all underling application's and
data.

------------------------------------------------------------------------
Tested version
------------------------------------------------------------------------
This issue was discovered in Citrix NetScaler SDX svm-10.5-50-1.9, other
versions may also be affected.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Citrix reports that this vulnerability is fixed in NetScaler 10.5 build
52.3nc.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_citrix_nitro_sdk_xen_hotfix_page.html