PT-2002-3138 · Citrix · Metaframe Presentation Server+2

Published 2002-12-31 · Updated 2011-03-08 · CVE-2002-2426

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Citrix Presentation Server versions 4.0 through 4.5 MetaFrame Presentation Server version 3.0 Access Essentials versions 1.0 through 2.0

Description A cross-site request forgery issue allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection.

Recommendations For Citrix Presentation Server versions 4.0 through 4.5, consider restricting access to the InitialProgram key in ICA connections to prevent unauthorized execution of applications. For MetaFrame Presentation Server version 3.0, restrict access to the InitialProgram key in ICA connections to minimize the risk of exploitation. For Access Essentials versions 1.0 through 2.0, avoid using the InitialProgram key in ICA connections until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2002-2426

Affected Products

Access Essentials

Citrix Presentation Server

Metaframe Presentation Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2002-2426 · Security Note
• http://secunia.com/advisories/27633 · Vendor Advisory
• http://vupen.com/english/advisories/2007/3870 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2426 · Note
• http://securitytracker.com/id?1018962 · Note
• http://support.citrix.com/article/CTX115245 · Note
• http://securityfocus.com/bid/26451 · Note
• http://gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor · Note
• http://packetstormsecurity.org/0210-exploits/hackingcitrix.txt · Note