pioneer
超级版主
积分 4563
发帖 4545
注册 2007-7-16
来自 BJ
|
#1 Citrix Presentation Server发布应用程序时的漏洞
来源
secunia.com
软件名
Citrix Access Essentials 1.x
Citrix MetaFrame Presentation Server 3.x
Citrix Presentation Server 4.x
Citrix Access Essentials 2.x
描述
这可恶意危害有漏洞的系统
激活ICA连接到Citrix Presentation Server发布应用程序和调用其它潜在的应用程序，可在用户被骗访问恶意网址或打开恶意.ICA文件时在Citrix Presentation Server上可调用已发布特定参数的应用程序
调用成功需要授权目标用户执行发布的应用程序并且Citrix Presentation Server被配置为允许传递参数到发布的应用程序
该漏洞在以下产品中已经确认：
* Access Essentials 1.0
* Citrix Access Essentials 1.5
* Citrix Access Essentials 2.0
* Citrix MetaFrame Presentation Server 3.0 for Microsoft Windows 2000
* Citrix MetaFrame Presentation Server 3.0 for Microsoft Windows 2003
* Citrix Presentation Server 4.0 for Microsoft Windows 2000
* Citrix Presentation Server 4.0 for Microsoft Windows 2003
* Citrix Presentation Server 4.0 x64 Edition
* Citrix Presentation Server 4.5 for Windows Server 2003
* Citrix Presentation Server 4.5 for Windows Server 2003 Feature Pack 1
* Citrix Presentation Server 4.5 for Windows Server 2003 x64 Edition
解决方案
厂商推荐执行最好的安全策略，并且提供了及时更新以确保应用程序名低可预测
Citrix Security Bulletin CTX114938 (Best practices):
http://support.citrix.com/article/CTX114938
Citrix Presentation Server 4.5 for Windows Server 2003:
http://support.citrix.com/article/CTX115275
Citrix Presentation Server 4.5 for Windows Server 2003 x64 Editions:
http://support.citrix.com/article/CTX115278
Citrix Presentation Server 4.0 for Windows 2000 Server:
http://support.citrix.com/article/CTX115276
Citrix Presentation Server 4.0 for Windows Server 2003:
http://support.citrix.com/article/CTX115277
| |
※文章所有权归【pioneer】与【东方微点论坛】共同所有，转载请注明出处！※
|
 |
|
