=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2010/VULN541
_____________________________________________________________________

DATE                      : 16/12/2010

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running
                             Citrix Access Gateway Enterprise version 8.0,8.1, 9.0, 9.1, 9.2
                             Citrix Access Gateway Standard Edition version 4.5, 4.6,
                             Citrix Access Gateway Advanced Edition version 4.5, 4.6,
                             Citrix Access Gateway VPX 4.6.

======================================================================
http://support.citrix.com/article/CTX127613
______________________________________________________________________

Vulnerability in Citrix Access Gateway legacy authentication support
could result in command injection
Document ID: CTX127613   /   Created On: Dec 14, 2010   /   Updated On: Dec 14, 2010

Severity: High


Description of Problem

A vulnerability has been identified in the NT4 authentication component
of Access Gateway Enterprise, and the NTLM authentication component
of Access Gateway Standard Edition that, when exploited, could allow
an attacker to subvert the authentication process. In some cases,
this could result in the attacker being able to execute commands
on the appliance in the context of the root user.

This vulnerability only affects Access Gateway customers that are
using the authentication methods specified above.

The vulnerable components are present in all versions of
Access Gateway Enterprise Edition up to version 9.2-49.8, and
all versions of the Access Gateway Standard and Advanced Editions
prior to Access Gateway 5.0.


What Customers Should Do

The use of the vulnerable authentication methods has been deprecated
in the Access Gateway product line, and support for these methods
has also been removed from the latest versions of these products.

Citrix recommends that affected customers review their use of the
deprecated components, and migrate to another authentication
method.

Acknowledgements

Citrix thanks George Gal of VSR (http://www.vsecurity.com/) for
working with us to protect Citrix customers


What Citrix Is Doing

Citrix is notifying customers and channel partners about this
potential security issue. This article is also available from
the Citrix Knowledge Center at http://support.citrix.com/.


Obtaining Support on This Issue

If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical Support
are available at http://www.citrix.com/site/ss/supportContacts.asp.

Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. If you
would like to report a security issue to Citrix, please compose
an e-mail to secure@citrix.com stating the exact version of the
product in which the vulnerability was found and the steps needed
to reproduce the vulnerability

This document applies to:

    * Access Gateway 4.5 Advanced Edition
    * Access Gateway 4.5 Standard Edition
    * Access Gateway 4.6 Advanced Edition
    * Access Gateway 4.6 Standard Edition
    * Access Gateway 8.0 Enterprise Edition
    * Access Gateway 8.1 Enterprise Edition
    * Access Gateway 9.0 Enterprise Edition
    * Access Gateway 9.1 Enterprise Edition
    * Access Gateway 9.2 Enterprise Edition
    * Access Gateway VPX 4.6


======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================