-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2007.0088 -- AUSCERT ALERT
                                   [Win]
Citrix Access Gateway and Advanced Access Control multiple vulnerabilities
                               9 August 2007

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Citrix Access Gateway Standard Edition 4.5.2 and prior
                      Citrix Access Gateway Advanced Edition 4.5.2 and prior
                      Citrix Advanced Access Control 4.2 and prior
Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
                      Administrative Compromise
                      Inappropriate Access
                      Provide Misleading Information
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-3679 CVE-2007-4013 CVE-2007-4015
                      CVE-2007-4016 CVE-2007-4018
Member content until: Monday, August 20 2007

Revision History:  August 9 2007: Added additional CVE Names
                    July 23 2007: Initial Release


OVERVIEW:

	Citrix Access Gateway and Advanced Access Control products contain
	several vulnerabilities, one of which is critical.


IMPACT:

	1. A remote attacker can execute arbitrary code compromising 
	   client computers when the user visits a malicious web page.

	   After compromising the client computer an attacker may then 
	   have full control of future Citrix sessions from the client.

	2. A remote attacker may reconfigure the Access Gateway appliance if
	   the administrator visits a malicious URL while logged in to the
	   web based administration console.
	

MITIGATION:

	Citrix has released Access Gateway firmware 4.5.5 and Advanced Access
	Control version HF1 addressing these vulnerabilities [6][7].

	Additionally, Citrix states that the following components should be 
	manually removed from each individual user account on the client 
	computer, since allowing the server to upgrade the client will 
	not remove the vulnerable versions:

	VPN ActiveX components: Net6Helper.DLL (ActiveX control) 4.5.2 and prior

	EPA Components: npCtxCAO.dll (ActiveX control) 4.5.0.0 and prior
	                npCtxCAO.dll (Firefox plugin) present in two locations


DETAILS:

	1. The affected Citrix products implement a clientless SSL VPN by using
	   ActiveX controls or Firefox plugins downloaded to the client machine.
	   When connecting to the server, as part of client validation, these 
	   components may download and execute programs from the remote server. 

	   A remote attacker may embed the legitimate Citrix ActiveX or Firefox
	   plugin in a malicious webpage causing the client to download and 
	   run software of the attacker's choosing on visiting the page [1][5].

	2. A cross-site request forgery vulnerability in the administrative 
	   web interface of these Citrix appliances potentially allows a remote 
	   attacker to make unauthorized configuration changes if the 
	   administrator visits a malicious URL while logged in to the device [2].

	3. Residual information left on the client device may allow an attacker 
	   to hijack the user's active session [3].

	4. An unspecified vulnerability allows an attacker to redirect a user's 
	   browser to an arbitrary web site [4].


REFERENCES:

	[1] CTX113815 - Vulnerabilities could result in arbitrary code execution
	    http://support.citrix.com/article/CTX113815

	[2] CTX113817 - Vulnerabilities could allow unauthorized configuration changes 
	    http://support.citrix.com/article/CTX113817

	[3] CTX113814 - Access Gateway Advanced Edition information disclosure and session hijacking 
	    http://support.citrix.com/article/CTX113814

	[4] CTX113816 - Access Gateway Advanced Edition redirection to arbitrary web sites
	    http://support.citrix.com/article/CTX113816

	[5] SYMSA-2007-006 - Citrix EPA ActiveX Control Design Flaw
	    http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-006.txt

	[6] Download - Access Gateway Appliance firmware 4.5.5
	    http://support.citrix.com/article/CTX114028

	[7] Download - Advanced Access Control HF1
	    http://support.citrix.com/article/CTX112803


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRrpztSh9+71yA2DNAQLj+wP/SbzrFRgm0Zsfp9IHwEwP6R1rJbAWL+U/
lVwS+e1mGQs1/UA4lJx/IbqWpL+PX75eypug5KPILYc28+Tf0ZjZLMo1rPGmyDux
ul9amQPFCxp6YUPtzHJF6DbNmQrtBnfxWlUqNE0gU3KCm4zViC9m04GWc2il/9nZ
gSbBdNbVFqk=
=wTkw
-----END PGP SIGNATURE-----