=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2007/VULN467
_____________________________________________________________________

DATE                      : 28/10/2008

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Citrix Web Interface 5.0
                               for Java Application Servers.

======================================================================
http://support.citrix.com/article/CTX118768
______________________________________________________________________

Vulnerability in Citrix Web Interface 5.0 for Java Application Servers
could result in failure to terminate Web Interface user sessions

Document ID: CTX118768   /   Created On: Oct 24, 2008   /
Updated On: Oct 24, 2008

Severity: Medium

Description of Problem

A vulnerability has been identified in Citrix Web Interface 5.0 for Java
Application Servers that could result in the disconnection process failing
to correctly terminate a user’s Web Interface session. This could potentially
allow other authenticated users to gain unauthorized access to the existing
Web Interface session using the same browser instance.

This vulnerability only affects Web Interface versions 5.0 and 5.0.1 when
deployed with a Java application server. Older versions of Web Interface
for Java Application Servers and all versions of Web Interface for Microsoft
Internet Information Services are not affected by this issue.

Mitigating Factors

      • This vulnerability can only be exploited by an attacker with
access to the same browser instance as the authorized user

      • In order to exploit this vulnerability, an attacker would
require valid credentials for the target Web Interface site

What Customers Should Do

This vulnerability has been addressed in Citrix Web Interface 5.0.2 for Java
Application Servers. Citrix recommends that customers upgrade to this version.
This upgrade can be obtained from the product downloads section of the Citrix
Web site (My Citrix account required) at https://www.citrix.com/site/SS/downloads/.

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential security
issue. This article is also available from the Citrix Knowledge Center at
http://support.citrix.com/.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix Technical
Support. Contact details for Citrix Technical Support are available at
http://www.citrix.com/site/ss/supportContacts.asp.

Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and considers any
and all potential vulnerabilities seriously. If you would like to report a security
issue to Citrix, please compose an e-mail to secure@citrix.com stating the exact
version of the product in which the vulnerability was found and the steps needed
to reproduce the vulnerability.

This document applies to:

    * Web Interface 5.0



======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================