Description: A vulnerability and a weakness have been reported in Citrix Presentation Server, which can be exploited by malicious users to bypass certain security restrictions.
1) An unspecified error within access control to published applications and published desktops can be exploited to access a desktop session without authorisation.
2) A weakness in Citrix Presentation Server when using SecureICA or ICA Basic encryption may allow a client to establish a connection with encryption settings that are lower than the minimum configured by the administrator.
NOTE: This weakness does not affect the use of SSL/TLS by Citrix Presentation Server.
The vulnerability and weakness affect the following products and versions:
* Citrix Presentation Server 4.5 for Windows Server 2003
* Citrix Presentation Server 4.5 for Windows Server 2003 x64 Editions
* Citrix Presentation Server 4.0 for Windows 2000 Server (only affected by vulnerability #1)
* Citrix Presentation Server 4.0 for Windows Server 2003
* Citrix Access Essentials 2.0
* Citrix Access Essentials 1.5
* Citrix Access Essentials 1.0
* Citrix Desktop Server 1.0 for Windows Server 2003
* Citrix Desktop Server 1.0 for Windows Server 2003 x64 Editions (only affected by vulnerability #1)
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
