Advisory Details

January 17th, 2008

Citrix Metaframe Presentation Server IMA Service Heap Overflow Vulnerability

ZDI-08-002
ZDI-CAN-212

CVE ID CVE-2008-0356
CVSS SCORE
AFFECTED VENDORS Citrix
AFFECTED PRODUCTS Metaframe Server
TREND MICRO CUSTOMER PROTECTION Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 5469. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Citrix Presentation Server. Authentication is not required to exploit this vulnerability.

The specific flaw resides in the Independent Management Architecture service, ImaSrv.exe, which listens by default on TCP port 2512 or 2513. The process trusts a user-suppled value as a parameter to a memory allocation. By supplying a specific value, an undersized heap buffer may be allocated. Subsequently, an attacker can then overflow that heap buffer by sending an overly large packet leading to arbitrary code execution in the context of the SYSTEM user.

ADDITIONAL DETAILS Citrix has issued an update to correct this vulnerability. More details can be found at:
http://support.citrix.com/article/CTX114487
DISCLOSURE TIMELINE
  • 2007-07-20 - Vulnerability reported to vendor
  • 2008-01-17 - Coordinated public release of advisory
CREDIT Eric DETOISIEN
BACK TO ADVISORIES