A vulnerability and a weakness have been reported in Citrix Presentation Server, which can be exploited by malicious users to bypass certain security restrictions.

1) An unspecified error within access control to published applications and published desktops can be exploited to access a desktop session without authorisation.

2) A weakness in Citrix Presentation Server when using SecureICA or ICA Basic encryption may allow a client to establish a connection with encryption settings that are lower than the minimum configured by the administrator.

NOTE: This weakness does not affect the use of SSL/TLS by Citrix Presentation Server.

The vulnerability and weakness affect the following products and versions:
* Citrix Presentation Server 4.5 for Windows Server 2003
* Citrix Presentation Server 4.5 for Windows Server 2003 x64 Editions
* Citrix Presentation Server 4.0 for Windows 2000 Server (only affected by vulnerability #1)
* Citrix Presentation Server 4.0 for Windows Server 2003
* Citrix Access Essentials 2.0
* Citrix Access Essentials 1.5
* Citrix Access Essentials 1.0
* Citrix Desktop Server 1.0 for Windows Server 2003
* Citrix Desktop Server 1.0 for Windows Server 2003 x64 Editions (only affected by vulnerability #1)

Solution
Apply hotfixes (see vendor advisories for details).
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
CTX114893:
http://support.citrix.com/article/CTX114893

CTX116941:
http://support.citrix.com/article/CTX116941

Deep Links
Links available to Secunia VIM customers