TippingPoint Zero Day Initiative
 

Citrix Metaframe Presentation Server IMA Service Heap Overflow Vulnerability

ZDI-08-002: January 17th, 2008

CVE ID

Affected Vendors

Affected Products

TippingPoint™ IPS Customer Protection

TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 5469. For further product information on the TippingPoint IPS:

Vulnerability Details

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Citrix Presentation Server. Authentication is not required to exploit this vulnerability.

The specific flaw resides in the Independent Management Architecture service, ImaSrv.exe, which listens by default on TCP port 2512 or 2513. The process trusts a user-suppled value as a parameter to a memory allocation. By supplying a specific value, an undersized heap buffer may be allocated. Subsequently, an attacker can then overflow that heap buffer by sending an overly large packet leading to arbitrary code execution in the context of the SYSTEM user.

Vendor Response

Citrix has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline

    2007-07-20 - Vulnerability reported to vendor
    2008-01-17 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:
    Eric DETOISIEN