Citrix NetScaler weak cryptography
Published:		26.11.2007
Source:		BUGTRAQ
SecurityVulns ID:		8379
Type:		remote
Level:		5/10
Description:		Username/password are stored as a part of cookie with encryption (XORing with reused key), making it's possible to discover parts of the password.

Affected:		CITRIX : NetScaler 8.0
CVE:		CVE-2007-6037 (Cross-site scripting (XSS) vulnerability in ws/generic_api_call.pl in Citrix NetScaler 8.0 build 47.8 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter and other unspecified parameters.)

Original document

nnposter_(at)_disclosed.not, Citrix NetScaler Web Management Cookie Weakness (26.11.2007)

Discuss:

Read or add your comments to this news (0 comments)