====================================================================

                             CERT-Renater

                  Note d'Information No. 2012/VULN300
____________________________________________________________________

DATE                :  27/07/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running Citrix Provisioning Services
                       versions up to and including 6.1.

======================================================================
http://support.citrix.com/article/CTX133039
______________________________________________________________________

Vulnerability in Citrix Provisioning Services Could Result in Arbitrary
Code Execution

Document ID: CTX133039
Created On: May 1, 2012
Updated On: May 1, 2012

Average Rating: 5 (2 ratings)

Severity: High

Description of Problem

A vulnerability has been identified in Citrix Provisioning Services
that could result in arbitrary code execution. This vulnerability can
be triggered by an attacker sending a specially crafted packet to the
Provisioning Services server.

This vulnerability is present in all supported versions of Citrix
Provisioning Services up to and including version 6.1.

Mitigating Factors

In a typical deployment, the vulnerable component will not be
accessible from the Internet.

What Customers Should Do

This vulnerability has been addressed in a series of hotfixes for
affected versions of Citrix Provisioning Services. Citrix strongly
recommends that customers apply the required hotfix for their
Provisioning Services deployments. These hotfixes can be found at the
following locations:

Citrix Provisioning Services 6.1:

http://support.citrix.com/article/CTX133149

Citrix Provisioning Services 6.0:

http://support.citrix.com/article/CTX133148

Citrix Provisioning Services 5.6 Service Pack 3:

http://support.citrix.com/article/CTX133187

Acknowledgements

Citrix thanks an anonymous researcher, working with iDefense
(http://www.idefense.com), for working with us to protect Citrix
customers

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential
security issue. This article is also available from the Citrix
Knowledge Center
at http://support.citrix.com/.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical Support
are available at http://www.citrix.com/site/ss/supportContacts.asp.

Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. If you would
like to report a security issue to Citrix, please compose an e-mail to
secure@citrix.com stating the exact version of the product in which the
vulnerability was found and the steps needed to reproduce the
vulnerability

This document applies to:

    Provisioning Services 5.0
    Provisioning Services 5.1
    Provisioning Services 5.6
    Provisioning Services 5.6 Service Pack 1
    Provisioning Services 6.0
    Provisioning Services 6.1

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================