bugtraq - cqure.net.20040430.citrixmetaframe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0404301007110.25855-100000@foofighter.smufsa.nu>
Date: Fri, 30 Apr 2004 10:12:43 +0200 (CEST)
From: Patrik Karlsson <patrik@...re.net>
To: bugtraq@...urityfocus.com
Subject: cqure.net.20040430.citrixmetaframe

Hi,

The following advisory has been released by cqure.net.
The severity level has been set to low, as in Citrix's advisory
available at;

http://support.citrix.com/kb/entry.jspa?entryID=4289&categoryID=118

The reason for the low severity is the fact that you have to be local
admin on the Citrix server itself to perform the attack.

That said, an attacker attacking for example an ASP could still end up
with admin privileges on a couple of customer domains and local network
access to a few thousands of workstations. Since the access to drives is
tunneled through the clients ICA session a firewall would not block this.
Then again an attacker could probably do a lot worse things as local
admin :)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

============================================================
cqure.net Security Vulnerability Report
No: cqure.net.20040430.citrixmetaframe
============================================================

Vulnerability Summary
- -------------------
Severity: Low

Threat:	An administrator can access all of the Citrix user's
	client drives

Products:
        MetaFrame XP Presentation Server for Windows 1.0
        MetaFrame 1.8

Platforms: All

Solution: Apply vendor supplied patches

Vulnerability Description
- -----------------------
It is possible for an administrator to mount any client
drive available in any user's Citrix session.

The drive has to be mounted on the client (local or network
drive) but does not need to be mounted inside the Citrix
session. Access to the drives is granted as the user running
the Citrix client.

Solution
- ------
Apply the patches outlined in the Citrix advisory;
http://support.citrix.com/kb/entry.jspa?entryID=4289
&categoryID=118

Additional Information
- --------------------
It should be noted that administrative access to the
Citrix Server is required to achieve this particular attack.
There are of course other approaches to achieving the same end
result even with the patch applied to the system being the
local administrator.

This advisory is available at http://www.cqure.net

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3

iQA/AwUBQJIIqk8V4IWk13ufEQI13QCg63MqunM28K7RpaJ82ntcrHQXK7QAn2OI
cqJHSX86VQnG/eKx6t+S5YgC
=aZ8r
-----END PGP SIGNATURE-----

-- 
Patrik Karlsson, patrik@...re.net
http://www.cqure.net