Description of Problem
The installers for some versions of MetaFrame add a registry key with an insecure access control list. On vulnerable servers this registry key could potentially be used to elevate the privileges of authenticated users.
This vulnerability is present in versions of MetaFrame up to and including MetaFrame XP 1.0 Feature Release 1. Installations of later versions of MetaFrame and Presentation Server could also be affected if they have at some point been upgraded from a vulnerable version.
Any server running on Windows Server 2003 will not be affected by this as none of the versions supported on this platform add the insecure access control list.
Mitigating Factors
This vulnerability cannot be exploited by anonymous users; to be able to exploit this an attacker would need to be able to log on locally to the server, or be able to make remote registry key changes.
What Customers Should Do
Citrix recommends that affected customers install the released hotfix to address this issue; this can be downloaded from the following location:
http://support.citrix.com/hotfixes.jsp
Acknowledgements
Citrix thanks Andres Tarasco of
SIA Group for reporting this issue and working with us to protect our customers.
What Citrix Is Doing
Citrix is proactively notifying customers and channel partners about this potential security issue. An article containing the information in this bulletin is available from the Citrix Knowledge Base at
http://support.citrix.com/.
Obtaining Support on this Issue
If you require technical assistance with this issue, please contact Citrix Technical Support. Information for contacting Citrix Technical Support is available at
http://support.citrix.com/.
Reporting Security Vulnerabilities to Citrix
Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities very seriously. If you would like to report a security issue to Citrix, please compose an e-mail to
secure@citrix.com containing the exact version of the product in which the vulnerability was found and steps to reproduce the vulnerability.
Linear Mode
