Citrix Metaframe Patches ?

[jamor1999]

Hey guys, maybe I'm just getting paranoid, but I want to make sure I'm not missing anything here. I currently have Microsoft nofications being sent to my inbox whenever a security patch for select OSs is released. Is there such a feature provided by citrix perhaps at Citrix.com? Are the feauture releases all we need, or are there patches often available as far as security is concerned?

Do any Citrix security experts have any comments regarding Citrix Metaframe and it's security?

 

[JeffHicks]

No, Citrix does not have a security updates mailing list. I inquired about this and they do not plan to do that in the near future.

A search through the knowledgebase found some security rollup patches for specific configurations (i.e. German XPe, or XP SP2 on NT4 TSE) and some security bulletins with general security information or (again) information on specific products and configurations (NFuse 1.5) My point is that since Citrix is a smaller piece of the puzzle than Microsoft's operating system, there are simply fewer opportunities for coding mistakes that lead to security holes (that and I personally think Citrix hires better programmers). I could not find any security patches that looked relevant to my environment and it is pretty standard (Win2K SP3, XPe FR2, Nfuse 1.7, ICA 6.3).

There are tons of security holes once a user has access to your server though (via published app or desktop). If you haven't you should look into using security policies or GPO (if you have Active Directory) to disable things like task manager that give users the ability to a run command. You should secure the file system and registry as tightly as you can without breaking your applications. Really too many tweaks to go over. Good luck.

 

[jamor1999]

Thank you so much! And agree - better programmers, but also a smaller peice of the puzzle. I've been hesitant to play with GPOs - our vps, etc. have been babied in the past and they get really upset (like children!!!) when something simple changes (like 'my desktop looks differt' - yeah, you're just missing the network neighborhood which you didn't know how to use anyway!). oooiii

but yes, sounds like the way to go if you need to cya - which i do.

sounds like a plan!