CVE-2006-5821: Buffer Overflow
First published: Fri Nov 10 2006(Updated: )
Heap-based buffer overflow in the IMA_SECURE_DecryptData1 function in ImaSystem.dll for Citrix MetaFrame XP 1.0 and 2.0, and Presentation Server 3.0 and 4.0, allows remote attackers to execute arbitrary code via requests to the Independent Management Architecture (IMA) service (ImaSrv.exe) with invalid size values that trigger the overflow during decryption.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Citrix Presentation Server | =4.0 | |
| Citrix Presentation Server | =4.0 | |
| Citrix MetaFrame | =1.0 | |
| Citrix MetaFrame | =3.0 | |
| Citrix Presentation Server | =4.0 | |
| =1.0 | ||
| =3.0 | ||
| =4.0 | ||
| =4.0 | ||
| =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.zerodayinitiative.com/advisories/ZDI-06-038.html
- http://support.citrix.com/article/CTX111186
- http://www.securityfocus.com/bid/20986
- http://secunia.com/advisories/22802
- http://securitytracker.com/id?1017205
- http://www.vupen.com/english/advisories/2006/4429
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30148
- http://www.securityfocus.com/archive/1/451337/100/100/threaded
Frequently Asked Questions
What is the severity of CVE-2006-5821?
CVE-2006-5821 has a critical severity level due to its potential to allow remote code execution.
How do I fix CVE-2006-5821?
To mitigate CVE-2006-5821, you should apply the latest patches or updates provided by Citrix for the affected versions.
Which versions of Citrix are affected by CVE-2006-5821?
CVE-2006-5821 affects Citrix MetaFrame XP versions 1.0 and 2.0, and Citrix Presentation Server versions 3.0 and 4.0.
Can CVE-2006-5821 be exploited remotely?
Yes, CVE-2006-5821 can be exploited remotely by sending specially crafted requests to the IMA service.
What component is vulnerable in CVE-2006-5821?
CVE-2006-5821 specifically affects the IMA_SECURE_DecryptData1 function in the ImaSystem.dll.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/remedy
- agent/weakness
- agent/first-publish-date
- agent/description
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/citrix
- canonical/citrix presentation server
- version/citrix presentation server/4.0
- canonical/citrix metaframe
- version/citrix metaframe/1.0
- version/citrix metaframe/3.0