Citrix Provisioning Services 'streamprocess.exe' Component Remote Code Execution Vulnerability

Bugtraq ID:	45914
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jan 19 2011 12:00AM
Updated:	Jan 10 2012 08:40PM
Credit:	AbdulAziz Hariri and the Zero Day Initiative
Vulnerable:	Citrix Provisioning Services 5.6
Not Vulnerable:

Citrix Provisioning Services 'streamprocess.exe' Component Remote Code Execution Vulnerability

Citrix Provisioning Services is prone to a remote code-execution vulnerability.

An attacker can exploit this vulnerability to execute arbitrary code in the context of the SYSTEM user.

The issue affects versions prior to Citrix Provisioning Services 5.6 SP1.

Citrix Provisioning Services 'streamprocess.exe' Component Remote Code Execution Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit is available:

• /data/vulnerabilities/exploits/45914.rb

Citrix Provisioning Services 'streamprocess.exe' Component Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

Citrix Provisioning Services 'streamprocess.exe' Component Remote Code Execution Vulnerability

References:

• Citrix Homepage (Citrix)
  
• Vulnerability in Citrix Provisioning Services could result in Arbitrary Code Exe (Citrix)
  
• ZDI-11-023: Citrix Provisioning Services streamprocess.exe Remote Code Execution (Zero Day Initiative)