full-disclosure - DDIVRT-2008-16 Citrix Broadcast Server 6.0 login.asp SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2571D31D42513640AE1632FEE100E0E40246F314@hypercom.defense.local>
Date: Tue, 23 Dec 2008 08:47:07 -0600
From: "Vulnerability Research" <VulnerabilityResearch@...frontline.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: DDIVRT-2008-16 Citrix Broadcast Server 6.0
	login.asp SQL Injection

Title
-----
DDIVRT-2008-16 Citrix Broadcast Server 6.0 login.asp SQL Injection

Severity
--------
High

Date Discovered
---------------
October 14, 2008

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Corey LeBleu and r@...$

Vulnerability Description
-------------------------
The Citrix Broadcast Server administrative login page is vulnerable to
trivial SQL injections via the txtUID HTTP POST parameter.  An attacker
could leverage this flaw to obtain unauthorized access to the web
interface or to extract data from the database via blind SQL injection.


Solution Description
--------------------
Citrix has released a patch for this flaw as described in Document ID
CTX119315.  Digital Defense, Inc. would like that thank Citrix for
quickly addressing this security vulnerability.  

Tested Systems / Software (with versions)
------------------------------------------
Windows 2003 with Citrix BCS 6.0 for Citrix Access Gateway.  Other
versions of the Citrix BCS may be vulnerable. According to Citrix
Document ID  CTX119315, the Avaya AG250 Broadcast Server 2.0 is also
vulnerable to this flaw.

Vendor Contact
--------------
Citrix Systems, Inc.
www.citrix.com
secure@...rix.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/