NTP Vulnerability–Citrix Security Advisory - CTX200355

Citrix has posted a Security Advisory today regarding NTP exploits - CTX200355

CVE-2014-9293

CVE-2014-9294

CVE-2014-9295

CVE-2014-9296

By default NTP is disabled on NetScaler appliances, however if NTP has been configured Citrix recommends taking the following steps.

Open the NetScaler’s ntp.conf file in /etc and add the following lines:

restrict -4 default notrap nopeer nomodify noquery

restrict -6 default notrap nopeer nomodify noquery

All other restrict statements should also be reviewed and verified to contain both 'nomodify' and 'noquery'.

Save the file after editing and restart the NTP service.

Remote Desktop license issue with Grace Period timeout

Issue was discovered with Windows Server 2012 RDS license service remaining in Grace Period after license service is applied.

"The remote session was disconnected because there are no Remote Desktop License Servers available to provide a license"

This is due to a bug in Server 2012 RDS licensing system. The RDS licening mechanism continues counting the Grace Period time.

There is a Microsoft hotfix available or follow the workaround. 

http://support.microsoft.com/kb/2916846

To manually resolve:

HKLM\System\CurrentControlSet\Control\Terminal Server\RCM

Grant permissions of the following registry key

If the key Grace Period is present the license service has not removed the entry and will continue in an unlicensed mode.

The fix is the delete the Grace Period key 

You will need to take ownership and grant permissions to the registry key

Reboot the the server

If the Grace Period key returns after the reboot, the listed hotfix must be applied

Open File - Security Warning when access content from file server

After moving APPDATA to a shared location to allow for users to roam between Citrix / Terminal Server systems, users were getting a warning notification when attempting to launch application shortcuts or access resources from this file server. Open File - Security Warning. This file is in a location outside your local network. Files from locations you don't recognize can harm your PC. Only open this file if you trust the location.

This is a per user setting in the registry and the easiest method I've found for setting this value is via a Group Policy registry setting.

I've launched Group Policy Management from the domain controller and selected the policy that applies to the users when logging into Citrix.

From the tree on the left expand User Configuration | Preferences | Windows Settings









Right click on Registry and select New | Registry Item

Action: Update
Hive: HKEY_CURRENT_USER
Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\[server name and/or FQDN]
Value Name: file
Value type: REG_DWORD
Value data: 1

Now I've added two entries, one for the server name, and one for the server fqdn.  That way if a user accesses a resource as servername or servername.domain.xxx they are both covered by this policy.

After updating the GPO, and logging off then back on the system the policy is in effect and no more warnings.

The fix is to add the file server to the Internet Settings sites list in a less restrictive zone.

Here are the value data definitions if you prefer to not add the server as a local Intranet Zone site.

Value definitions:

1 = Local Intranet Zone

2 = Trusted sites zone

3 = Internet zone

4 = Restricted zone