cnvd-2017-01545
Vulnerability from cnvd
Title
Citrix License Server for Windows and License Server VPX开放重定向漏洞
Description
Citrix License Server for Windows和License Server VPX都是美国思杰系统（Citrix Systems）公司的产品。前者是一款基于Windows系统的认证服务器，后者是一款认证服务器设备。 Citrix License Server for Windows and License Server VPX存在开放重定向漏洞。攻击者利用该漏洞执行特制的URI并诱导用户点击。当用户点击该链接时会被重定向到攻击者控制的网站，造成钓鱼攻击。
Severity
中
Patch Name
Citrix License Server for Windows and License Server VPX开放重定向漏洞的补丁
Patch Description
Citrix License Server for Windows和License Server VPX都是美国思杰系统（Citrix Systems）公司的产品。前者是一款基于Windows系统的认证服务器，后者是一款认证服务器设备。 Citrix License Server for Windows and License Server VPX存在开放重定向漏洞。攻击者利用该漏洞执行特制的URI并诱导用户点击。当用户点击该链接时会被重定向到攻击者控制的网站，造成钓鱼攻击。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://support.citrix.com/article/CTX219885

Reference
http://www.securityfocus.com/bid/96028
Impacted products
Name
['Citrix License Server for Windows <=11.14.0.1', 'Citrix License Server VPX <=11.14.0.1']
Show details on source website

To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "96028"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-5571",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5571"
    }
  },
  "description": "Citrix License Server for Windows\u548cLicense Server VPX\u90fd\u662f\u7f8e\u56fd\u601d\u6770\u7cfb\u7edf\uff08Citrix Systems\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002\u524d\u8005\u662f\u4e00\u6b3e\u57fa\u4e8eWindows\u7cfb\u7edf\u7684\u8ba4\u8bc1\u670d\u52a1\u5668\uff0c\u540e\u8005\u662f\u4e00\u6b3e\u8ba4\u8bc1\u670d\u52a1\u5668\u8bbe\u5907\u3002\r\n\r\nCitrix License Server for Windows and License Server VPX\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u7279\u5236\u7684URI\u5e76\u8bf1\u5bfc\u7528\u6237\u70b9\u51fb\u3002\u5f53\u7528\u6237\u70b9\u51fb\u8be5\u94fe\u63a5\u65f6\u4f1a\u88ab\u91cd\u5b9a\u5411\u5230\u653b\u51fb\u8005\u63a7\u5236\u7684\u7f51\u7ad9\uff0c\u9020\u6210\u9493\u9c7c\u653b\u51fb\u3002",
  "discovererName": "Jan Rude",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://support.citrix.com/article/CTX219885",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-01545",
  "openTime": "2017-02-20",
  "patchDescription": "Citrix License Server for Windows\u548cLicense Server VPX\u90fd\u662f\u7f8e\u56fd\u601d\u6770\u7cfb\u7edf\uff08Citrix Systems\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002\u524d\u8005\u662f\u4e00\u6b3e\u57fa\u4e8eWindows\u7cfb\u7edf\u7684\u8ba4\u8bc1\u670d\u52a1\u5668\uff0c\u540e\u8005\u662f\u4e00\u6b3e\u8ba4\u8bc1\u670d\u52a1\u5668\u8bbe\u5907\u3002\r\n\r\nCitrix License Server for Windows and License Server VPX\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u7279\u5236\u7684URI\u5e76\u8bf1\u5bfc\u7528\u6237\u70b9\u51fb\u3002\u5f53\u7528\u6237\u70b9\u51fb\u8be5\u94fe\u63a5\u65f6\u4f1a\u88ab\u91cd\u5b9a\u5411\u5230\u653b\u51fb\u8005\u63a7\u5236\u7684\u7f51\u7ad9\uff0c\u9020\u6210\u9493\u9c7c\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Citrix License Server for Windows and License Server VPX\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Citrix License Server for Windows \u003c=11.14.0.1",
      "Citrix License Server VPX \u003c=11.14.0.1"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/96028",
  "serverity": "\u4e2d",
  "submitTime": "2017-02-10",
  "title": "Citrix License Server for Windows and License Server VPX\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.