Gustavo Gurmandi has reported a vulnerability in Citrix MetaFrame Presentation Server, which can be exploited by malicious users to bypass certain security restrictions.

The vulnerability is caused due to a validation error when policy filtering decisions are made based on the user's client name. This can be exploited by malicious users to bypass certain policy restrictions by modifying the client name in the "launch.ica" file

The vulnerability has been reported in the following versions:
* Citrix MetaFrame Presentation Server 3.0 for Microsoft Windows 2000
* Citrix MetaFrame Presentation Server 3.0 for Microsoft Windows 2003
* Citrix Presentation Server 4.0 for Microsoft Windows 2000
* Citrix Presentation Server 4.0 for Microsoft Windows 2003

Solution
Do not use client names for policy filtering decision.

Provided and/or discovered by
Gustavo Gurmandi, GrupoITPro Security Research Community.

Changelog
Further details available in Customer Area

Original Advisory
Citrix:
http://support.citrix.com/kb/entry!default.jspa?categoryID=275&externalID=CTX107705

GrupoITPro Security Research Community:
http://www.grupoitpro.com.ar/ctxpoliciesbypass.txt

Deep Links
Links available in Customer Area