How secure is Citrix Presentation Server after you do a default installation?

I for one am a little skeptical about the claim made in the article.   When the article title specifically mentions "Citrix" and then the second paragraph is "Global Secure Systems (GSS) acknowledged that the issues it claims to have discovered are not the fault of Citrix itself." is somewhat misleading.

Toward the end of the article, "Robin Hollington, director of consulting at GSS, said: 'Imagine how your board would feel if they discovered that a junior clerk had subverted controls to gain access to board members' restricted network drives.'  Is this one of the vulernabilities? or is the director making something up?  I highly doubt this was one of the vulenerabilities but a scare tatic designed to drum up business.

Perhaps there are 5 BIG vulnerabilities, buthe article only make a claim and provides nothing to back it up.  No proof, no examples, nothing.  If these vulernability are that bad,  I think its important for the rest of the world to know what they are and how they can deal with it.  Holding this type of information randsom makes the company out to look like a legal scam artist.

Anyways, we all know there are some holes and backdoors in the OS, but those are relatively minor.  A lot of time, those hole are exposed in order to make a poorly designed application work. 

Joe 

Is it safe to drive a car without any driving licence...
What append it you let the administrator set up a "allow all" rule in a firewal...
What if...

We are supposed to be trained and skills profesionals. Experienced people cost money! That's why I saw (especially since "W2K bug" and "Euro passage in 2001") a lot of basic pseudo system administrators covering task that should normally belong to senior administrator and Project managers just because they were less expensive to recruit...

Let's talk about rules...

1- no direct connexion to PS servers - WI+SG... probably AG+ workstation scan in a near futur
2- no published desktop, only published app (if home made, no web help or about feature)
3- Token authentication for all remote users
4- no direct connexion  from PS servers to network  (firewall for each applicaiton port)
5- Internet Explorer blocked (iexplorer.exe) on all servers except intranet dedicated ones and internet specials dedicated ones (reimage every night, investigating Ardence system)
6- currently testing AppSense and PowerFuse to lock down windows environment

probably much more on GPO but out of my knowledge...

...revolve around the use of published content for the most part.  They are addressed by Citrix in CTX114938 and CTX115245.  I haven't seen the report, but my guess would be that GSS used known problems in applications that were published, exploiting them by passing specially crafted command lines to the apps via a tweaked ICA file. This could allow the injection of arbitrary code and making the system vulnerable to further remote exploitation.  It makes sense and the recommendations in the Citrix CTX articles are pretty common-sense and not much of a burden to implement if you don't use content redirection.  If you do, it just means that you need to be careful about the applications you use it with and keep up on any security bulletins that may involve those particular apps.

This is not a Citrix bug, but it does exploit a feature and it is something that admins do need to be aware of.  

It's not immediately clear what this sentence means -- it's an awkward sentence, does this mean remove execute permissions etc.??

Thank you!!

And this is a security risk how?  You cannot connect to another Published Application if you do not have access to it.

Modify the .ica file all you want,  it's no different that using Program Neighborhood.  If it was such a big deal, Citrix would have done something with it by now.

This is another attempt by Dan to spread FUD about Citrix and Pimp his own product.

Please read what I actually wrote rather than reply to your own conceptions of my statements. I wrote "that can have security implications", not "that is a security hole". Sure, through proper configuration and attention to detail a Citrix expert can configure a server so that a hacked .ica file cannot be used to compromise it. But if details are overlooked or mistakes are made then this can become a vulnerability. As a poster below wrote:

I haven't seen the report, but my guess would be that GSS used known problems in applications that were published, exploiting them by passing specially crafted command lines to the apps via a tweaked ICA file. This could allow the injection of arbitrary code and making the system vulnerable to further remote exploitation

CPS is a good product and we strive to emulate (and extend) much of the functionality that it provides. This does not mean that we don't improve on it's design where we can. Not allowing end-users to save and edit configuration files is such an improvement IMO.

Remove execute permissions on users' home folders??
What if home folder is on another server as a share that is redirected to My Documents??

Wouldn't people be unable to edit files etc.??
A few words about this part of the comment would help too.

I'd really like to prevent people from installing apps and plugins and whatnot and this remove execute permissions idea seems like it might help, since Group Policy can't cover every single executable out there...

Thank you, Tom 

>> if home made, no web help or about feature

just curious what is the danger in having an "About" screen for a homemade app? 

Brian,

Regarding ICA files - I will deffer to you as you obviously know more about Citrix than I ever will.

Regarding my original post: when I read in your article "Citrix Presentation Server? (Or plain Terminal Server or Provision Networks / Quest Software's Virtual Access Suite.)" I had mistakingly assumed that you were interested in all SBC products and not just those particular three. In my original post I therefore pointed out one particular technical difference between CPS and Ericom PowerTerm WebConnect that according to other posters here may have security implications. I did not even say that Ericom PowerTerm WebConnect  as a whole was more or less secure than CPS.

Given that according to you my POV is not welcome here I will stop.

The ICA file issue is not related to some of the past ICA file security issues (lack of ticketing, weak credential protection, etc).  This type of exploit could be used if a common 3rd party program had a know buffer overflow that could be exploited from the command line (or via an associated document type).  An attacker could create an ica file (or a file with a commonly associated file type) with some best guesses at the application name, and send those out in mass via email.   If the application was common enough (an MS Office app, for example) then odds are that with enough targets it would be feasible that they could get a few hits.  If you read ctx114938 it addresses this scenario, so Citrix obviously does not consider it FUD. 

I do think that the headline here is misleading, since enabling client to server content redirection and adding the %* to the published app location are not default behaviors in PS4 or 4.5.  This whole thing is not really a Citrix problem, it's a problem with the applications running on the server and admins not considering all of the implications of how those applications could be exposed to exploitation.