Description of Problem

A vulnerability has been identified in the XML Service interface of XenApp and XenDesktop that could potentially be used by a remote, unauthenticated attacker to execute arbitrary code in the context of a service account on a XenApp or XenDesktop server.

The vulnerability could potentially be exploited by sending a specially crafted packet to the vulnerable component. In deployments where the XML service is used to validate credentials or tickets provided by external users, there is a risk that the vulnerability could be exploited by Internet based attackers.

This vulnerability is present in the following products:

• All versions of XenApp and XenApp Fundamentals (formerly known as Access Essentials) up to and including Version 6

• XenDesktop 4 with, or without, Feature Packs 1 or 2

XenDesktop 5 is not affected by this vulnerability.

Mitigating Factors

The use of an appropriate strong authentication solution can help to reduce the risks of this issue being exploited by an Internet-based attacker. Citrix recommends that customers make use of a strong authentication solution in all Internet-facing deployments.

What Customers Should Do

Hotfixes have been released to address this issue. Citrix strongly recommends that affected customers install these hotfixes, which can be downloaded from the following locations:

Citrix XenApp 6 for Windows Server 2008 R2:

EN - http://support.citrix.com/article/CTX127036
FR - http://support.citrix.com/article/CTX128361

DE - http://support.citrix.com/article/CTX128360

JA - http://support.citrix.com/article/CTX128363

ES - http://support.citrix.com/article/CTX128359

SC - http://support.citrix.com/article/CTX128362

Citrix XenApp 5 for Windows Server 2008 x86:

EN - http://support.citrix.com/article/CTX125414

FR - http://support.citrix.com/article/CTX125415

DE - http://support.citrix.com/article/CTX125416

JA - http://support.citrix.com/article/CTX125417

ES - http://support.citrix.com/article/CTX125418

Citrix XenApp 5 for Windows Server 2008 x64:

EN - http://support.citrix.com/article/CTX125419

FR - http://support.citrix.com/article/CTX125420

DE - http://support.citrix.com/article/CTX125421

JA - http://support.citrix.com/article/CTX125422

ES - http://support.citrix.com/article/CTX125423

Citrix Presentation Server 4.5 with Feature Pack/XenApp 5 for Windows Server 2003 x86:

EN - http://support.citrix.com/article/CTX127660

FR - http://support.citrix.com/article/CTX127661

DE - http://support.citrix.com/article/CTX127662

JA - http://support.citrix.com/article/CTX127663

ES - http://support.citrix.com/article/CTX127664

Citrix Presentation Server 4.5 with Feature Pack/XenApp 5 for Windows Server 2003 x64:

EN - http://support.citrix.com/article/CTX127665

FR - http://support.citrix.com/article/CTX127666

DE - http://support.citrix.com/article/CTX127667

JA - http://support.citrix.com/article/CTX127668

ES - http://support.citrix.com/article/CTX127669

Citrix XenDesktop 4 for Windows Server 2003 x86:
EN - http://support.citrix.com/article/CTX128127
JA - http://support.citrix.com/article/CTX128128

Citrix XenDesktop 4 for Windows Server 2003 x64:
EN - http://support.citrix.com/article/CTX128130
JA - http://support.citrix.com/article/CTX128129

Citrix Access Essentials/XenApp Fundamentals 3.0:

EN - http://support.citrix.com/article/CTX125414

FR - http://support.citrix.com/article/CTX125415

DE - http://support.citrix.com/article/CTX125416

JA - http://support.citrix.com/article/CTX125417

ES - http://support.citrix.com/article/CTX125418

Citrix Access Essentials 2.0:

EN - http://support.citrix.com/article/CTX127660

FR - http://support.citrix.com/article/CTX127661

DE - http://support.citrix.com/article/CTX127662

ES - http://support.citrix.com/article/CTX127664

Acknowledgements

Citrix thanks AbdulAziz Hariri, working with iDefense (http://www.idefense.com), for working with us to protect Citrix customers.

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential security issue. This article is also available from the Citrix Knowledge Center at http://support.citrix.com/.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at http://www.citrix.com/site/ss/supportContacts.asp.

Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. If you would like to report a security issue to Citrix, please compose an e-mail to secure@citrix.com stating the exact version of the product in which the vulnerability was found and the steps needed to reproduce the vulnerability.