|
Citrix Presentation Server Weakness and Unauthorised Access
|
|
Secunia Advisory:
|
SA30271
|
|
|
Release Date:
|
2008-05-15
|
|
Last Update:
|
2008-05-22
|
|
Popularity:
|
2,580 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Security Bypass
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Citrix Access Essentials 1.x
Citrix Access Essentials 2.x
Citrix Desktop Server 1.x
Citrix Presentation Server 4.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2008-2299
CVE-2008-2300
|
|
Description:
A vulnerability and a weakness have been reported in Citrix Presentation Server, which can be exploited by malicious users to bypass certain security restrictions.
1) An unspecified error within access control to published applications and published desktops can be exploited to access a desktop session without authorisation.
2) A weakness in Citrix Presentation Server when using SecureICA or ICA Basic encryption may allow a client to establish a connection with encryption settings that are lower than the minimum configured by the administrator.
NOTE: This weakness does not affect the use of SSL/TLS by Citrix Presentation Server.
The vulnerability and weakness affect the following products and versions:
* Citrix Presentation Server 4.5 for Windows Server 2003
* Citrix Presentation Server 4.5 for Windows Server 2003 x64 Editions
* Citrix Presentation Server 4.0 for Windows 2000 Server (only affected by vulnerability #1)
* Citrix Presentation Server 4.0 for Windows Server 2003
* Citrix Access Essentials 2.0
* Citrix Access Essentials 1.5
* Citrix Access Essentials 1.0
* Citrix Desktop Server 1.0 for Windows Server 2003
* Citrix Desktop Server 1.0 for Windows Server 2003 x64 Editions (only affected by vulnerability #1)
Solution:
Apply hotfixes (see vendor advisories for details).
http://support.citrix.com/article/CTX116941
http://support.citrix.com/article/CTX114893
Provided and/or discovered by:
Reported by the vendor.
Changelog:
2008-05-21: Added CVE reference.
2008-05-22: Added CVE reference.
Original Advisory:
CTX114893:
http://support.citrix.com/article/CTX114893
CTX116941:
http://support.citrix.com/article/CTX116941
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
