lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <9CE75E98979ABC448892B4284A51E252CA9AC4444C@kestrel.london.contextis.co.uk>
Date: Wed, 4 Aug 2010 14:15:00 +0100
From: Context IS - Disclosure <disclosure@...textis.co.uk>
To: "'full-disclosure@...ts.grok.org.uk'" <full-disclosure@...ts.grok.org.uk>, 
	"'bugtraq@...urityfocus.com'" <bugtraq@...urityfocus.com>
Subject: Heap Offset Overflow in Citrix ICA Clients

===============================ADVISORY===============================
Systems Affected:    Citrix ICA Client
Severity:            High
Category:            Heap Offset Overflow
Author:              Context Information Security Ltd
Reported to vendor:  20th February 2008
Advisory Issued:     4th August 2010
===============================ADVISORY===============================

Description
-----------
The Citrix Presentation Server Client (test on v10.150) does not perform bounds checking on the type field in an ICA "graphics" packet.  This lack of checking allows for a remote exploitation of a user that has the client installed.  

The exploit can be triggered by sending a user to a malicious webpage that causes an ICA file to be downloaded. This automatically connects to a simulated ICA server, which can trigger the remote code execution and take control over the client.


Analysis
--------
The ICA client software is vulnerable to an offset overflow heap exploit.  The ICA client does not correctly validate input from network data in the graphics packets.  This allows arbitrary code execution on a victim's computer that connects to a malicious ICA server.  A user with the ICA client installed will automatically connect to an ICA server that is provided via a URL.  

Therefore if a user clicks on a malicious link, opens an ".ICA" file via email or is redirected to a malicious server the exploit will be launched against the user.

The exploit works by providing an ".ICA" file to the web browser which instructs the browser to load the ICA client and connect to the malicious server.  The server is not a real ICA server but software which simulates the initially negotiation of an ICA connection and then launches the exploit.

  
Technologies Affected
---------------------
Citrix Client 10 for Windows, Mac, Linux, Solaris and Windows Mobile


Vendor Response
---------------
Citrix advise users to upgrade to the latest version of the Citrix client.  See the following Citrix support article for more details:
http://support.citrix.com/article/CTX125975


Disclosure Timeline
-------------------
20th February 2008 - Vendor Notification
26th February 2008 - Vendor Response for more Details
3rd March 2008 - Vendor Confirm Vulnerability
3rd August 2010 - Vendor Patch Released


Credits
--------
Michael Jordon of Context Information Security Ltd


About Context Information Security
----------------------------------

Context Information Security is an independent security consultancy specialising in both technical security and information assurance services The company was founded in 1998. Its client base has grown steadily over the years, thanks in large part to personal recommendations from existing clients who value us as business partners. We believe our success is based on the value our clients place on our product-agnostic, holistic approach; the way we work closely with them to develop a tailored service; and to the independence, integrity and technical skills of our consultants.
The company's client base now includes some of the most prestigious blue chip companies in the world, as well as government organisations.

The best security experts need to bring a broad portfolio of skills to the job, so Context has always sought to recruit staff with extensive business experience as well as technical expertise. Our aim is to provide effective and practical solutions, advice and support: when we report back to clients we always communicate our findings and recommendations in plain terms at a business level as well as in the
form of an in-depth technical report.

Web:		www.contextis.co.uk
Email: 	disclosure@...textis.co.uk



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ