CVE-2008-0356

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 73.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-01-18 · updated 2026-06-16
Weakness: CWE-119

Description

Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513.

Affected products

Citrix Access Essentials: through 2.0
Citrix Desktop Server: 1.0 (and their updates)
Citrix Metaframe Presentation Server: through 4.5
Citrix Presentation Server: all versions

References

http://secunia.com/advisories/28508
http://support.citrix.com/article/CTX114487
http://www.kb.cert.org/vuls/id/412228
http://www.securityfocus.com/archive/1/486585/100/0/threaded
http://www.securityfocus.com/bid/27329
http://www.securitytracker.com/id?1019231
http://www.vupen.com/english/advisories/2008/0172
http://zerodayinitiative.com/advisories/ZDI-08-002.html
http://secunia.com/advisories/28508
http://support.citrix.com/article/CTX114487
http://www.kb.cert.org/vuls/id/412228
http://www.securityfocus.com/archive/1/486585/100/0/threaded

Get alerted when CVE-2008-0356 or the next vulnerability affects your stack