Citrix XenApp and XenDesktop XML Service Remote Code Execution Vulnerability

Bugtraq ID:	46511
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Feb 23 2011 12:00AM
Updated:	Feb 23 2011 12:00AM
Credit:	AbdulAziz Hariri
Vulnerable:	Citrix XenDesktop 4 Citrix XenApp Fundamentals 6.0 Citrix XenApp Fundamentals 3.0 Citrix XenApp 6.0 Citrix XenApp 5.0 Citrix Presentation Server 4.0 Feature Pack 1
Not Vulnerable:

Citrix XenApp and XenDesktop XML Service Remote Code Execution Vulnerability

Citrix XenApp and XenDesktop are prone to a remote code-execution vulnerability.

An attacker can exploit this vulnerability to execute arbitrary code in the context of the SYSTEM user.

The following products are affected:

Feature Pack 1 for Presentation Server 4.5
XenApp 5.0 for Windows Server 2003 x64
XenApp 5.0 for Windows Server 2003 x86
XenApp 6.0 for Windows Server 2008 R2
XenApp Fundamentals 3.0
XenApp Fundamentals 6.0 for Windows Server 2008 R2
XenDesktop 4 x32
XenDesktop 4 x64

Citrix XenApp and XenDesktop XML Service Remote Code Execution Vulnerability

Currently, we are not aware of any patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Citrix XenApp and XenDesktop XML Service Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

Citrix XenApp and XenDesktop XML Service Remote Code Execution Vulnerability

References:

• Vulnerabilities in XenApp and XenDesktop could result in arbitrary code executi (Citrix )
  
• Citrix Homepage (Citrix)