Secunia Research: Citrix Access Gateway Plug-in for Windows nsepacom ActiveX Control Integer Overflow

======================================================================

                 Secunia Research 01/08/2012

          - Citrix Access Gateway Plug-in for Windows -
      - "nsepacom" ActiveX Integer Overflow Vulnerability -

======================================================================
Table of Contents

Affected Software…1
Severity…2
Vendor's Description of Software…3
Description of Vulnerability…4
Solution…5
Time Table…6
Credits…7
References…8
About Secunia…9
Verification…10

======================================================================
1) Affected Software

• Citrix Access Gateway Plug-in for Windows version 9.3.49.5.

NOTE: Other versions may also be affected.

======================================================================
2) Severity

Rating: Highly critical
Impact: System access
Where: From remote

======================================================================
3) Vendor's Description of Software

"Citrix Access Gateway Plug-in is client software for Windows XP and
Windows Vista (32-bit) that enables secure connectivity through
Access Gateway, Enterprise Edition."

Product Link:
http://www.citrix.com/site/ss/downloads/details.asp?downloadId=
1535878&productId=15005

======================================================================
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in Citrix Access
Gateway Plug-in for Windows, which can be exploited by malicious
people to compromise a user's system.

The vulnerability is caused by an integer overflow error in the
nsepacom ActiveX control (nsepa.exe) when processing HTTP responses
based on the request via the "StartEpa()" method. This can be
exploited to cause a heap-based buffer overflow via a specially
crafted "Content-Length" HTTP response header.

Successful exploitation may allow execution of arbitrary code.

======================================================================
5) Solution

No official solution is currently available.

======================================================================
6) Time Table

19/07/2011 - Vendor notified.
21/07/2011 - Vendor response.
20/01/2012 - Requested status update.
08/02/2012 - Vendor response, fix not scheduled.
09/05/2012 - Requested status update.
09/05/2012 - Vendor response, fix scheduled for June.
03/07/2012 - Requested status update.
21/07/2012 - Vendor response, fix delayed.
01/08/2012 - Public disclosure.

======================================================================
7) Credits

Discovered by Dmitriy Pletnev, Secunia Research.

======================================================================
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2011-2593 for the vulnerability.

======================================================================
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

======================================================================
10) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2012-26/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================