发布日期：2010-07-29
更新日期：2010-07-29

受影响系统：

Citrix XenServer

描述：

---

BUGTRAQ  ID: 42150
CVE(CAN) ID: CVE-2010-2990

Citrix XenServer产品线是一种企业级平台，通过灵活的聚合计算和存储资源对数据中心的服务器虚拟化进行管理。

Citrix XenApp Online插件和ICA客户端在处理ICA "graphics"报文内的"type"字段时存在错误，当用户建立了恶意服务器的ICA连接时，可被利用执行任意代码。

<*来源：Michael Jordon （disclosure@contextis.co.uk）
  
  链接：http://secunia.com/advisories/40808
        http://support.citrix.com/article/CTX125975
*>

建议：

---

厂商补丁：

Citrix
------
Citrix已经为此发布了一个安全公告（CTX125975）以及相应补丁:

CTX125975：Vulnerability in Citrix Online Plug-Ins and ICA Clients Could Result in Arbitrary Code Execution

链接：http://support.citrix.com/article/CTX125975

补丁下载：

Citrix Online Plug-in for Mac for XenApp & XenDesktop:
This issue has been resolved in version 11.0 and later. The latest version of this client is available from the following location:
http://www.citrix.com/English/ss/downloads/details.asp?downloadId=1862769&productId=186&c1=sot2755
Citrix ICA Client for Linux (x86 and ARM):
This issue has been resolved in version 11.100 and later. The latest version of this client is available from the following location:
http://www.citrix.com/English/ss/downloads/details.asp?downloadId=3323&productId=186&c1=sot2755
Citrix ICA Client for Solaris (x86 and Sparc):
This issue has been resolved in version 8.63 and later. The latest version of this client is available from the following location:
http://www.citrix.com/English/ss/downloads/details.asp?downloadId=1859901&productId=186&c1=sot2755
Citrix Receiver for Windows Mobile:
This issue has been resolved in version 11.5 and later. The latest version of this client is available from the following location:
http://www.citrix.com/English/ss/downloads/results.asp?productID=186&c1=sot2755&c2=ost1859501

浏览次数：1714
严重程度：0（网友投票）