Citrix, TM1 client (9.1) and NX bit

[Olivier]

Hi Everybody,

I have not posted in the forum for a while but i finally got an occasion as i am hit by a question from our Citrix administrator that i am not sure have been covered in the forum yet.

We are looking in activating an hardware security configuration on our Citrix servers knowed as "NX_bit".

http://en.wikipedia.org/wiki/NX_bit

The NX bit, which stands for No eXecute, is a technology used in CPUs to segregate areas of memory for use by either storage of processor instructions (or code) or for storage of data, a feature normally only found in Harvard architecture processors. However, the NX bit is being increasingly used in conventional von Neumann architecture processors, for security reasons.
An operating system with support for the NX bit may mark certain areas of memory as non-executable. The processor will then refuse to execute any code residing in these areas of memory. The general technique, known as executable space protection, is used to prevent certain types of malicious software from taking over computers by inserting their code into another program's data storage area and running their own code from within this section; this is known as a buffer overflow attack.
Intel markets the feature as the XD bit, for eXecute Disable. AMD uses the name Enhanced Virus Protection. The ARM architecture refers to the feature as XN for eXecute Never; it was introduced in ARM v6.

When this "feature" is turned on in the citrix server the Tm1 client will not load in citrix instances and we are prompted to remove the Tm1 Add In from Excel.


I am only starting my review on this but i thought i would throw a bottle in the Tm1 forum sea just in case somebody else has also looked in this subject.

We will also raise the question to IBM as well in the coming days and i ll update this post accordingly to provided answer if any

Any advice, comment, suggestion, appreciated as usual,

Kind Regards,

[Olivier]

Hi everybody,

The question was raised to IBM and the following answer was provided.

As promised, I followed on up this query of yours overnight, I went to development as I have not actually heard of this parameter before.
Unfortunately, they had not either, this is the response I got back from them:
In looking at the WIKI for this NX setting - it talks about having some correlation to DEP (Data Execution Prevention)

Hardware-enforced DEP enables the NX bit on compatible CPUs, through the automatic use of PAE kernel in 32-bit Windows and the native support on 64-bit kernels. Windows Vista DEP works by marking certain parts of memory as being intended to hold only data, which the NX or XD bit enabled processor then understands as non-executable.[1] This helps prevent buffer overflow attacks from succeeding

I can tell you that TM1 does not use PAE switches.
This DEP thing has come up before with Tm1 and if it is turned on it has caused some problems for the Tm1 server running properly.

This is all I can get you at this point.
We really have never ran into a problem with Tm1 Perspectives on Citrix and if the server is allowing the Perspectives client to only have 3 GB of RAM that is no different then any regular 32 bit system out there running widows 2003 Enterprise or Data Center with the /3GB switch on.

So in our situation where we use Citrix/VMware only to provide Excel and Tm1 perspectives client to remote locations,
i believe there is no impact.


Kind Regards,
Olivier