Check Point Advisories

Security Best Practice: Blocking Citrix ICA Vulnerabilities

Check Point Reference:	SBP-2008-26
Date Published:	15 Aug 2008
Severity:	Medium
Last Updated:	Tuesday 01 January, 2008
Source:	IPS Research Center
Protection Provided by:
Who is Vulnerable?	Citrix ICA
Vulnerability Description	Independent Computing Architecture (ICA) is a proprietary protocol for an application server system, designed by Citrix Systems. The protocol lays down a specification for passing data between server and clients. ICA is broadly similar in purpose to window servers such as the X Window System. It also provides for the feedback of user input from the client to the server, and a variety of means for the server to send graphical output, as well as other media such as audio, from the running application to the client.
Vulnerability Details	Citrix ICA Protocol Enforcement - This protection checks the validation negotiation stage of the Citrix ICA connection. The first few packets sent from the client are inspected to ensure they follow the Citrix ICA protocol. Citrix ICA Unauthorized Application - This protection allows the blocking of Citrix-delivered applications that are not explicitly allowed in the "Authorized applications" list.