| Presentation Server Published Application Execution Weakness |
| Thursday, 15 November 2007 by Michel Roth | |||
|
The problem is that published applications and potentially other applications can be launched when invoking an ICA connection to a Citrix Presentation Server. This can be exploited to e.g. launch published applications with specially crafted parameters on a Citrix Presentation Server when a user is tricked into visiting a malicious website or opening a malicious .ICA file. What this means in Citrix admin language is that you could edit a ICA file and alter the "InitialProgram" parameter. This could then, if the server is not properly locked down and if the default settings for published application were altered, allow you to start any program you like. A little far fetched but certainly not impossible (there's Internet-facing Citrix configurations you wouldn't believe). In fact, there's this "hacker" out there who wanted to share this with the world. Anyway, this was worrying enough for Citrix to issue a security bulletin and implement a "fix" for this. It's in PSE450R01W2K3035 (fix for 4.5) and PSE400R04W2K3012 (for PS 4.0). What they did was make the name of published applications harder to predict. To achieve this, the fix appends a token to the Application Name when the application is published. The token is a circumflex followed by a random combination of eight characters/digits. For example, if you publish Microsoft Word with an Application Name of "MS Word" and a Display Name of "Word," users see "Word" when enumerating the application, and an .ica file lists the application as #"Word^XXXXXXXX." No changes are made to the application's Display Name (the name of the application as it appears in client interfaces) except for Program Neighborhood custom connections, where the Display Name is equal to the Application Name as it appears in the application's Properties page in the console.
Show/Hide comment form
 |
|||
