|
Brought to you by:
Suppliers of:
|
|
|
| |
Citrix Program Neighborhood Agent is a part of the Citrix Presentation Server Client and facilitates access to Citrix published applications.
Remote exploitation of a design error in Citrix Systems Inc.'s allows attackers to execute arbitrary code under the privileges of the client user and to create arbitrary shortcuts under the privileges of the client user. |
| |
Credit:
The information has been provided by iDEFENSE.
The original article can be found at: http://www.idefense.com/application/poi/display?id=238&type=vulnerabilities and
http://www.idefense.com/application/poi/display?id=237&type=vulnerabilities
The vendor advisory for this vulnerability is available at: http://support.citrix.com/kb/entry.jspa?externalID=CTX105650
|
| |
Vulnerable Systems:
* Citrix MetaFrame Program Neighborhood version 8.00.24737
Neighborhood Agent Buffer Overflow:
The problem specifically exists in the client code responsible for handling the caching of information received from the server. The Program Neighborhood Agent caches information from published applications in the AppCache folder, located in the users profile directory. Cached icon filenames are named after the published application. The filename is constructed from a series of calls to lstrcatA() into a stack based buffer. Because of insufficient bounds checking, a stack based buffer overflow can occur after the second call to lstrcatA() as the filename read from the XML element <InName> is being added to the AppCache folder path. This leads to the eventual execution of arbitrary code.
Exploitation requires that an attacker establish a malicious server and cause or convince the target user to connect to it via the Program Neighborhood Agent. This can be accomplished by social engineering or automatically when combined with a DNS or ARP spoofing attack.
Exploitation of this vulnerability is not trivial. In order to exploit this vulnerability reliably, an attacker must determine the length of the target user's username. In some cases, this information can be gleaned with standard Windows tools such as NBTSTAT. Furthermore, because requests are cached by the client, an attacker in most cases has only one window of opportunity to perform a successful attack.
Workaround:
Utilize the server IP address instead of the name to circumvent DNS spoofing attacks.
Neighborhood Agent Arbitrary Shortcut Creation:
The problem specifically exists in that an attacker who has established a malicious server can create arbitrary shortcuts to the client user's Startup folder by specifying the following directive:
<AppInStartmenu value="true" root="programs">startup</AppInStartmenu>
An attacker can specify the UNC path to an arbitrary malicious binary, and this binary will be executed the next time the client user reboots with an active network connection.
Exploitation requires that an attacker establish a malicious server and cause or convince the target user to connect to it via the Program Neighborhood Agent. This
can be accomplished by social engineering or automatically when combined with a DNS- or ARP-spoofing attack.
Workaround:
Utilize the server IP address instead of the name to circumvent DNS spoofing attacks.
CVE Information:
CAN-2004-1077
CAN-2004-1078
Vendor Status:
The client has released an update to the clients at the address: http://www.citrix.com/English/SS/downloads/downloads.asp?dID=2755
Disclosure Timeline:
11/23/2004 - Initial vendor notification
11/24/2004 - Initial vendor response
04/26/2005 - Coordinated public disclosure
|
|
|
|
|
