Heap Offset Overflow in Citrix ICA Clients

===============================ADVISORY===============================
Systems Affected: Citrix ICA Client
Severity: High
Category: Heap Offset Overflow
Author: Context Information Security Ltd
Reported to vendor: 20th February 2008
Advisory Issued: 4th August 2010
===============================ADVISORY===============================

Description

The Citrix Presentation Server Client (test on v10.150) does not perform bounds checking on the type field in an ICA "graphics" packet. This lack of checking allows
for a remote exploitation of a user that has the client installed.

The exploit can be triggered by sending a user to a malicious webpage that causes an ICA file to be downloaded. This automatically connects to a simulated ICA server,
which can trigger the remote code execution and take control over the client.

Analysis

The ICA client software is vulnerable to an offset overflow heap exploit. The ICA client does not correctly validate input from network data in the graphics packets.
This allows arbitrary code execution on a victim's computer that connects to a malicious ICA server. A user with the ICA client installed will automatically connect
to an ICA server that is provided via a URL.

Therefore if a user clicks on a malicious link, opens an ".ICA" file via email or is redirected to a malicious server the exploit will be launched against the user.

The exploit works by providing an ".ICA" file to the web browser which instructs the browser to load the ICA client and connect to the malicious server. The server
is not a real ICA server but software which simulates the initially negotiation of an ICA connection and then launches the exploit.

Technologies Affected

Citrix Client 10 for Windows, Mac, Linux, Solaris and Windows Mobile

Vendor Response

Citrix advise users to upgrade to the latest version of the Citrix client. See the following Citrix support article for more details:
http://support.citrix.com/article/CTX125975

Disclosure Timeline

20th February 2008 - Vendor Notification
26th February 2008 - Vendor Response for more Details
3rd March 2008 - Vendor Confirm Vulnerability
3rd August 2010 - Vendor Patch Released

Credits

Michael Jordon of Context Information Security Ltd

About Context Information Security

Context Information Security is an independent security consultancy specialising in both technical security and information assurance services The company was founded
in 1998. Its client base has grown steadily over the years, thanks in large part to personal recommendations from existing clients who value us as business partners.
We believe our success is based on the value our clients place on our product-agnostic, holistic approach; the way we work closely with them to develop a tailored
service; and to the independence, integrity and technical skills of our consultants.
The company's client base now includes some of the most prestigious blue chip companies in the world, as well as government organisations.

The best security experts need to bring a broad portfolio of skills to the job, so Context has always sought to recruit staff with extensive business experience as
well as technical expertise. Our aim is to provide effective and practical solutions, advice and support: when we report back to clients we always communicate our
findings and recommendations in plain terms at a business level as well as in the
form of an in-depth technical report.

Web: www.contextis.co.uk
Email: [email protected]