Comments on: 0day: Hacking secured CITRIX from outside http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/ Information Security Think Tank Tue, 06 Jan 2009 14:23:52 +0000 http://wordpress.org/?v=2.7 hourly 1 By: DH http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-121833 DH Wed, 14 May 2008 10:37:27 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-121833 Here is the fix, nice job PDP :-D XenApp 4.5 http://support.citrix.com/article/CTX116954 Here is the fix, nice job PDP :-D

XenApp 4.5
http://support.citrix.com/article/CTX116954

]]> By: Kaustubh Kumar http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-117085 Kaustubh Kumar Thu, 20 Mar 2008 23:15:33 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-117085 Hi All, I need help in hacking citrix which can allow me to open websites in the citrix metaframe. Hi All,
I need help in hacking citrix which can allow me to open websites in the citrix metaframe.

]]> By: Security Researcher Warns About Citrix Vulnerability http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-74219 Security Researcher Warns About Citrix Vulnerability Tue, 20 Nov 2007 06:58:10 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-74219 [...] “cutting-edge think tank” and a “creative hacker organization,” has «www.gnucitizen.org» about a cross-site request forgery attack that can be made in conjunction with a malicious [...] [...] “cutting-edge think tank” and a “creative hacker organization,” has «www.gnucitizen.org» about a cross-site request forgery attack that can be made in conjunction with a malicious [...]

]]> By: pdp http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-61715 pdp Fri, 26 Oct 2007 06:28:54 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-61715 Noob I haven't tested that but it should work in theory. Noob I haven’t tested that but it should work in theory.

]]> By: Noob http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-61579 Noob Thu, 25 Oct 2007 20:33:48 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-61579 Question: If the user does not have pass through enabled, but does have stored credentials in the client- (username, password, domain) - will the attack still work? Question:

If the user does not have pass through enabled, but does have stored credentials in the client- (username, password, domain) - will the attack still work?

]]> By: hackathology http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-60591 hackathology Mon, 22 Oct 2007 17:10:19 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-60591 i found out the clue i found out the clue

]]> By: hackathology http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-60590 hackathology Mon, 22 Oct 2007 17:09:42 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-60590 got it pdp. I found it got it pdp. I found it

]]> By: pdp http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-60542 pdp Mon, 22 Oct 2007 13:54:57 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-60542 hackathology, nope, it is different. you should be able to figure it out though. hackathology, nope, it is different. you should be able to figure it out though.

]]> By: Major Fukup http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-60504 Major Fukup Mon, 22 Oct 2007 11:50:56 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-60504 One of the reasons why you should always give users on these systems minimum rights. Does it require a published desktop? Which virtual channels do you use? Regards M.F. One of the reasons why you should always give users on these systems minimum rights.
Does it require a published desktop?
Which virtual channels do you use?

Regards M.F.

]]> By: hackathology http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-60476 hackathology Mon, 22 Oct 2007 10:20:14 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-60476 Is this the same vulnerability found here? http://support.citrix.com/article/CTX112589 Is this the same vulnerability found here?

http://support.citrix.com/article/CTX112589

]]> By: pdp http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-57501 pdp Fri, 12 Oct 2007 08:40:42 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-57501 Folk, apparently CITRIX has removed the YouTube videos due to some copyright violation. This is strange and the same time not the right way to handle security advisories. Still haven't got any response from them around the issue and I seriously doubt that this will ever happen. However, I am going to keep the POC private for now and give them a chance to react on the in sensible way. Folk, apparently CITRIX has removed the YouTube videos due to some copyright violation. This is strange and the same time not the right way to handle security advisories. Still haven’t got any response from them around the issue and I seriously doubt that this will ever happen. However, I am going to keep the POC private for now and give them a chance to react on the in sensible way.

]]> By: wekrid http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-57490 wekrid Fri, 12 Oct 2007 07:47:46 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-57490 will this hack also work with csg and cags? will this hack also work with csg and cags?

]]> By: pdp http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-57268 pdp Thu, 11 Oct 2007 18:40:27 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-57268 no user interaction is required! no user interaction is required!

]]> By: lol http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-57265 lol Thu, 11 Oct 2007 18:14:58 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-57265 it just seems to be the category clickmyexecutableiwonthurt "exploit". unfortunately we can't patch users. it just seems to be the category clickmyexecutableiwonthurt “exploit”. unfortunately we can’t patch users.

]]> By: pdp http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-57175 pdp Thu, 11 Oct 2007 11:22:57 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-57175 hellboy726, interesting site you have there! reminds me of 1998... but I like it. hellboy726, interesting site you have there! reminds me of 1998… but I like it.

]]> By: hellboy726 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-57173 hellboy726 Thu, 11 Oct 2007 11:15:53 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-57173 Nice! Nice!

]]> By: pdp http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-57169 pdp Thu, 11 Oct 2007 11:00:15 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-57169 rootkid, there is nothing on the horizon for me in europe for the rest of this year. feel free to contact me through! rootkid, there is nothing on the horizon for me in europe for the rest of this year. feel free to contact me through!

]]> By: rootkid http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-57164 rootkid Thu, 11 Oct 2007 10:49:21 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-57164 Oh bummer. Man, I was investigating the same stuff (citrix that is) at the moment, and somehow you are always a leap ahead. I hate that...:) Anyhow, good work as always. I would really like to have a chat with you someday if you happen to be around (any con you are on this year in europe?). Probably we can share ideas, if you like. Cheers. Oh bummer. Man, I was investigating the same stuff (citrix that is) at the moment, and somehow you are always a leap ahead. I hate that…:) Anyhow, good work as always. I would really like to have a chat with you someday if you happen to be around (any con you are on this year in europe?). Probably we can share ideas, if you like.
Cheers.

]]> By: zeridon http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-57126 zeridon Thu, 11 Oct 2007 07:10:46 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-57126 Looks nice, and also i see a storm brewing ... smth. like the 0day pdf. Looks nice,

and also i see a storm brewing … smth. like the 0day pdf.

]]> By: vindic http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside/comment-page-1/#comment-57090 vindic Thu, 11 Oct 2007 00:25:04 +0000 http://www.gnucitizen.org/blog/0day-hacking-secured-citrix-from-outside#comment-57090 Yes, very nice, thnx for good work ;) Yes, very nice, thnx for good work ;)

]]>