CVE-2006-6334 - Heap-based buffer overflow in the SendChannelData function in wfica.ocx in Citrix Presentation Serve

CVE-2006-6334

Summary

Heap-based buffer overflow in the SendChannelData function in wfica.ocx in Citrix Presentation Server Client before 9.230 for Windows allows remote malicious web sites to execute arbitrary code via a DataSize parameter that is less than the length of the Data buffer.

References

Vulnerable Configurations

cpe:2.3:a:citrix:presentation_server_client:*:*:windows:*:*:*:*:*
cpe:2.3:a:citrix:presentation_server_client:*:*:windows:*:*:*:*:*

CVSS

Base:	6.8 (as of 17-10-2018 - 21:47)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bid	21458
bugtraq	20061207 TSRT-06-15: Citrix Presentation Server Client ActiveX Heap Overflow Vulnerability
cert-vn	VU#210969
confirm	http://support.citrix.com/article/CTX111827 http://www.citrix.com/English/SS/downloads/downloads.asp?dID=2755
exploit-db	5106
misc	http://fortconsult.net/files/fortconsult.dk/citrix_advisory_dec2006.pdf http://www.tippingpoint.com/security/advisories/TSRT-06-15.html
sectrack	1017343
secunia	23246
sreason	1995
vupen	ADV-2006-4865
xf	citrix-wfica-bo(30740)

Last major update

17-10-2018 - 21:47

Published

08-12-2006 - 01:28

Last modified

17-10-2018 - 21:47