Vulnerability in Citrix Access Gateway Plug-In

CVE-2011-2593

Integer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a crafted Content-Length HTTP header, which triggers a heap-based buffer overflow.

EPSS: 0.040 (89.4th percentile) — read the EPSS interpretation.

Affected products

Citrix Access_gateway_plug-in — versions 10.0
N/a — versions n/a

Weakness classification (CWE)

CWE-189

References

PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, third-party-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_MISC)
PSIRT-CNA@flexerasoftware.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_XF)