Citrix Presentation Server ICA Protocol Weak Encryption Vulnerability

Bugtraq ID:	29233
Class:	Design Error
CVE:	CVE-2008-2299
Remote:	Yes
Local:	No
Published:	May 14 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Citrix Presentation Server 4.0 Citrix Presentation Server 4.5 Citrix MetaFrame Presentation Server 4.0 Citrix MetaFrame Presentation Server 3.0 Citrix Desktop Server 1.0 x64 Citrix Desktop Server 1.0 Citrix Access Essentials 2.0 Citrix Access Essentials 1.5 Citrix Access Essentials 1.0
Not Vulnerable:

Citrix Presentation Server ICA Protocol Weak Encryption Vulnerability

Citrix Presentation Server is prone to a vulnerability that allows weak encryption to be used.

Attackers can exploit this issue to force servers to use weaker encryption than what administrators had configured. This may aid in further attacks.

This issue affects the following products:

Versions up to Citrix Presentation Server 4.5
Versions up to Citrix Access Essentials 2.0
Citrix Desktop Server 1.0

Citrix Presentation Server ICA Protocol Weak Encryption Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Citrix Presentation Server ICA Protocol Weak Encryption Vulnerability

Solution:
The vendor has released an advisory along with hotfixes. Please see the references for more information.

Citrix Presentation Server ICA Protocol Weak Encryption Vulnerability

References:

• Citrix Homepage (Citrix)
  
• CTX114893: Vulnerability in Citrix Presentation Server could result in cryptogra (Citrix)