mailing list archives
Heap Offset Overflow in Citrix ICA Clients
From: Context IS - Disclosure <disclosure () contextis co uk>
Date: Wed, 4 Aug 2010 14:15:00 +0100
Systems Affected: Citrix ICA Client
Category: Heap Offset Overflow
Author: Context Information Security Ltd
Reported to vendor: 20th February 2008
Advisory Issued: 4th August 2010
The Citrix Presentation Server Client (test on v10.150) does not perform bounds checking on the type field in an ICA
"graphics" packet. This lack of checking allows for a remote exploitation of a user that has the client installed.
The exploit can be triggered by sending a user to a malicious webpage that causes an ICA file to be downloaded. This
automatically connects to a simulated ICA server, which can trigger the remote code execution and take control over the
The ICA client software is vulnerable to an offset overflow heap exploit. The ICA client does not correctly validate
input from network data in the graphics packets. This allows arbitrary code execution on a victim's computer that
connects to a malicious ICA server. A user with the ICA client installed will automatically connect to an ICA server
that is provided via a URL.
Therefore if a user clicks on a malicious link, opens an ".ICA" file via email or is redirected to a malicious server
the exploit will be launched against the user.
The exploit works by providing an ".ICA" file to the web browser which instructs the browser to load the ICA client and
connect to the malicious server. The server is not a real ICA server but software which simulates the initially
negotiation of an ICA connection and then launches the exploit.
Citrix Client 10 for Windows, Mac, Linux, Solaris and Windows Mobile
Citrix advise users to upgrade to the latest version of the Citrix client. See the following Citrix support article
for more details:
20th February 2008 - Vendor Notification
26th February 2008 - Vendor Response for more Details
3rd March 2008 - Vendor Confirm Vulnerability
3rd August 2010 - Vendor Patch Released
Michael Jordon of Context Information Security Ltd
About Context Information Security
Context Information Security is an independent security consultancy specialising in both technical security and
information assurance services The company was founded in 1998. Its client base has grown steadily over the years,
thanks in large part to personal recommendations from existing clients who value us as business partners. We believe
our success is based on the value our clients place on our product-agnostic, holistic approach; the way we work closely
with them to develop a tailored service; and to the independence, integrity and technical skills of our consultants.
The company's client base now includes some of the most prestigious blue chip companies in the world, as well as
The best security experts need to bring a broad portfolio of skills to the job, so Context has always sought to recruit
staff with extensive business experience as well as technical expertise. Our aim is to provide effective and practical
solutions, advice and support: when we report back to clients we always communicate our findings and recommendations in
plain terms at a business level as well as in the
form of an in-depth technical report.
Email: disclosure () contextis co uk
- Heap Offset Overflow in Citrix ICA Clients Context IS - Disclosure (Aug 04)