| Citrix Access Gateway With Advanced Access Control Vulnerabilities |
| Wednesday, 15 November 2006 by Michel Roth | |||
|
Vulnerability in Access Gateway appliance may allow information disclosure When using Advanced Access Control with an Access Gateway appliance, unauthenticated remote users may be able to gain access to data on the Access Gateway appliance. The information disclosed could potentially lead to a compromise of the appliance. This vulnerability affects the following products: • Access Gateway 4.5 Advanced Edition • Access Gateway 4.2 with Advanced Access Control 4.2 (currently known as Access Gateway 4.2 Advanced Edition) When deployed with: • Access Gateway appliance 4.2 • Access Gateway appliance 4.2.1 • Access Gateway appliance 4.2.2 Access Gateway appliances deployed without Advanced Access Control are not vulnerable to this issue. Vulnerability in Advanced Access Control could result in policy bypass when using the Browser-Only Access feature When using the Browser-Only access feature, Advanced Access Control may fail to enforce the correct policies on some resources. This could result in users being able to gain access to resources in violation of configured policies. This vulnerability is present in: • Access Gateway 4.2 with Advanced Access Control 4.2 (currently known as Access Gateway 4.2 Advanced Edition) • Advanced Access Control Option 4.0 (previously Access Gateway Enterprise 4.0) Access Gateway Standard Edition and Access Gateway Enterprise Edition are not vulnerable to this issue. Vulnerability in Advanced Access Control could result in policy bypass When using Advanced Access Control, users that login in a specific way may be able to gain access to resources in violation of configured policies. This vulnerability is present in: • Access Gateway 4.2 with Advanced Access Control 4.2 (currently known as Access Gateway 4.2 Advanced Edition) • Advanced Access Control Option 4.0 (previously Access Gateway Enterprise 4.0) Access Gateway Standard Edition and Access Gateway Enterprise Edition are not vulnerable to this issue.
Show/Hide comment form
|
|||
