Citrix MetaFrame XP Client Drive Access Vulnerability

Bugtraq ID:	10234
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 29 2004 12:00AM
Updated:	Apr 29 2004 12:00AM
Credit:	The vendor announced this vulnerability.
Vulnerable:	Citrix MetaFrame XP Presentation Server for Windows 1.0 Citrix MetaFrame XP for MS NT 4.0 Server Terminal Server 1.0 Citrix MetaFrame XP for Microsoft Windows 2003 1.0 Citrix MetaFrame XP for Microsoft Windows 2000 1.0 Citrix MetaFrame for MS NT 4.0 Server Terminal Server 1.8 Citrix MetaFrame for Microsoft Windows 2000 1.8
Not Vulnerable:

Citrix MetaFrame XP Client Drive Access Vulnerability

Citrix MetaFrame XP has been reported prone to an access validation vulnerability. It is reported that an Administrator may access the drives of a connected client using the clients ICA connection.

Citrix MetaFrame XP Client Drive Access Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Citrix MetaFrame XP Client Drive Access Vulnerability

Solution:
Citrix has released an alert(CTX103763) and hotfixes to address this issue. It is reported that the issue is also addressed in MetaFrame XP Presentation Server 3.0. Customers should refer to the referenced alert for further details regarding obtaining and applying hotfixes.

Citrix MetaFrame XP Client Drive Access Vulnerability

References:

• CTX103763 - Administrators May Be Able To Access Client Drives (Citrix)
  
• cqure.net.20040430.citrixmetaframe (Patrik Karlsson )