[NT] Citrix Neighborhood Agent Buffer Overflow and Arbitrary Shortcut Creation

• Previous message: SecuriTeam: "[UNIX] Netref Arbitrary Code Inclusion"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 27 Apr 2005 17:47:58 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Citrix Neighborhood Agent Buffer Overflow and Arbitrary Shortcut Creation
------------------------------------------------------------------------

SUMMARY

Citrix Program Neighborhood Agent is a part of the Citrix Presentation
Server Client and facilitates access to Citrix published applications.

Remote exploitation of a design error in Citrix Systems Inc.'s allows
attackers to execute arbitrary code under the privileges of the client
user and to create arbitrary shortcuts under the privileges of the client
user.

DETAILS

Vulnerable Systems:
 * Citrix MetaFrame Program Neighborhood version 8.00.24737

Neighborhood Agent Buffer Overflow:
The problem specifically exists in the client code responsible for
handling the caching of information received from the server. The Program
Neighborhood Agent caches information from published applications in the
AppCache folder, located in the users profile directory. Cached icon
filenames are named after the published application. The filename is
constructed from a series of calls to lstrcatA() into a stack based
buffer. Because of insufficient bounds checking, a stack based buffer
overflow can occur after the second call to lstrcatA() as the filename
read from the XML element <InName> is being added to the AppCache folder
path. This leads to the eventual execution of arbitrary code.

Exploitation requires that an attacker establish a malicious server and
cause or convince the target user to connect to it via the Program
Neighborhood Agent. This can be accomplished by social engineering or
automatically when combined with a DNS or ARP spoofing attack.

Exploitation of this vulnerability is not trivial. In order to exploit
this vulnerability reliably, an attacker must determine the length of the
target user's username. In some cases, this information can be gleaned
with standard Windows tools such as NBTSTAT. Furthermore, because requests
are cached by the client, an attacker in most cases has only one window of
opportunity to perform a successful attack.

Workaround:
Utilize the server IP address instead of the name to circumvent DNS
spoofing attacks.

Neighborhood Agent Arbitrary Shortcut Creation:
The problem specifically exists in that an attacker who has established a
malicious server can create arbitrary shortcuts to the client user's
Startup folder by specifying the following directive:

<AppInStartmenu value="true" root="programs">startup</AppInStartmenu>

An attacker can specify the UNC path to an arbitrary malicious binary, and
this binary will be executed the next time the client user reboots with an
active network connection.

Exploitation requires that an attacker establish a malicious server and
cause or convince the target user to connect to it via the Program
Neighborhood Agent. This
can be accomplished by social engineering or automatically when combined
with a DNS- or ARP-spoofing attack.

Workaround:
Utilize the server IP address instead of the name to circumvent DNS
spoofing attacks.

CVE Information:
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1077>
CAN-2004-1077
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1078>
CAN-2004-1078

Vendor Status:
The client has released an update to the clients at the address:
<http://www.citrix.com/English/SS/downloads/downloads.asp?dID=2755>
http://www.citrix.com/English/SS/downloads/downloads.asp?dID=2755

Disclosure Timeline:
11/23/2004 - Initial vendor notification
11/24/2004 - Initial vendor response
04/26/2005 - Coordinated public disclosure

ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDEFENSE.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=238&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=238&type=vulnerabilities and
 
<http://www.idefense.com/application/poi/display?id=237&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=237&type=vulnerabilities

The vendor advisory for this vulnerability is available at:
<http://support.citrix.com/kb/entry.jspa?externalID=CTX105650>
http://support.citrix.com/kb/entry.jspa?externalID=CTX105650

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[UNIX] Netref Arbitrary Code Inclusion"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]