===============================ADVISORY===============================
Systems Affected:    Citrix ICA Client
Severity:            High
Category:            Heap Offset Overflow
Author:              Context Information Security Ltd
Reported to vendor:  20th February 2008
Advisory Issued:     4th August 2010
===============================ADVISORY===============================

Description
-----------
The Citrix Presentation Server Client (test on v10.150) does not perform bounds checking on the type field in an ICA "graphics" packet.  This lack of checking allows for a remote exploitation of a user that has the client installed.  

The exploit can be triggered by sending a user to a malicious webpage that causes an ICA file to be downloaded. This automatically connects to a simulated ICA server, which can trigger the remote code execution and take control over the client.


Analysis
--------
The ICA client software is vulnerable to an offset overflow heap exploit.  The ICA client does not correctly validate input from network data in the graphics packets.  This allows arbitrary code execution on a victim's computer that connects to a malicious ICA server.  A user with the ICA client installed will automatically connect to an ICA server that is provided via a URL.  

Therefore if a user clicks on a malicious link, opens an ".ICA" file via email or is redirected to a malicious server the exploit will be launched against the user.

The exploit works by providing an ".ICA" file to the web browser which instructs the browser to load the ICA client and connect to the malicious server.  The server is not a real ICA server but software which simulates the initially negotiation of an ICA connection and then launches the exploit.

  
Technologies Affected
---------------------
Citrix Client 10 for Windows, Mac, Linux, Solaris and Windows Mobile


Vendor Response
---------------
Citrix advise users to upgrade to the latest version of the Citrix client.  See the following Citrix support article for more details:
http://support.citrix.com/article/CTX125975


Disclosure Timeline
-------------------
20th February 2008 - Vendor Notification
26th February 2008 - Vendor Response for more Details
3rd March 2008 - Vendor Confirm Vulnerability
3rd August 2010 - Vendor Patch Released


Credits
--------
Michael Jordon of Context Information Security Ltd


About Context Information Security
----------------------------------

Context Information Security is an independent security consultancy specialising in both technical security and information assurance services The company was founded in 1998. Its client base has grown steadily over the years, thanks in large part to personal recommendations from existing clients who value us as business partners. We believe our success is based on the value our clients place on our product-agnostic, holistic approach; the way we work closely with them to develop a tailored service; and to the independence, integrity and technical skills of our consultants.
The company's client base now includes some of the most prestigious blue chip companies in the world, as well as government organisations.

The best security experts need to bring a broad portfolio of skills to the job, so Context has always sought to recruit staff with extensive business experience as well as technical expertise. Our aim is to provide effective and practical solutions, advice and support: when we report back to clients we always communicate our findings and recommendations in plain terms at a business level as well as in the
form of an in-depth technical report.

Web:    www.contextis.co.uk
Email:   disclosure@contextis.co.uk