Check Point Advisories

Citrix Access Gateway Plug-in ActiveX Code Execution (CVE-2011-2882)

Check Point Reference: CPAI-2011-584
Date Published: 20 Dec 2011
Severity: High
Last Updated: Sunday 07 December, 2014
Source:
Industry Reference:CVE-2011-2882
Protection Provided by:

Security Gateway
R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description Citrix Access Gateway is an enhanced SSL VPN system which not only provides VPN access, but also enables application level access control. The system is available as standalone software, a physical appliance or a virtual machine. It is designed to work with Citrix XenApp and XenDesktop to allow further control and scalability. Users do not need to install additional software to access the VPN. All they need is Internet Explorer. Once they access the system with their browser, it initiates the transfer of an ActiveX control, nsepa.ocx to the client. An arbitrary code execution vulnerability exists in an ActiveX control that is part of Citrix Access Gateway Plug-in for Windows. The vulnerability is due to a buffer overflow in the SSL VPN ActiveX control while parsing certain HTTP responses. A remote attacker could exploit this vulnerability to execute arbitrary code in the security context of the target user, by enticing the target user to open a crafted HTML page. This can result in code execution in the context of the affected user. If code execution is unsuccessful, the Internet Explorer may terminate abnormally.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

  1. In the IPS tab, click Protections and find the Citrix Access Gateway Plug-in ActiveX Code Execution protection using the Search tool and Edit the protection's settings.
  2. Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name:  Web Client Enforcement Violation.
Attack Information:  Citrix Access Gateway plug-in ActiveX code execution

×
  Feedback
This website uses cookies for its functionality and for analytics and marketing purposes. By continuing to use this website, you agree to the use of cookies. For more information, please read our Cookies Notice.
OK