Red Hot Cyber

Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search

Citrix Netscaler ADC and Gateway plagued by serious DOS and Open Redirect flaw

Redazione RHC : 9 July 2024 14:21

Two vulnerabilities have been identified in NetScaler ADC and NetScaler Gateway. Affected Versions: The following supported versions of NetScaler ADC and NetScaler Gateway are vulnerable:

These devices are widely used to enhance application performance and ensure controlled and secure access to sensitive data.

  • NetScaler ADC and NetScaler Gateway 14.1 before version 14.1-25.53
  • NetScaler ADC and NetScaler Gateway 13.1 before version 13.1-53.17
  • NetScaler ADC and NetScaler Gateway 13.0 before version 13.0-92.31
  • NetScaler ADC 13.1-FIPS before version 13.1-37.183
  • NetScaler ADC 12.1-FIPS before version 12.1-55.304
  • NetScaler ADC 12.1-NDcPP before version 12.1-55.304

Note: Version 12.1 of NetScaler ADC and NetScaler Gateway is now End Of Life (EOL) and therefore vulnerable. Customers are advised to upgrade their devices to supported versions.

Iscriviti GRATIS alla RHC Conference 2025 (Venerdì 9 maggio 2025)

Il giorno Venerdì 9 maggio 2025 presso il teatro Italia di Roma (a due passi dalla stazione termini e dalla metro B di Piazza Bologna), si terrà la RHC Conference 2025. Si tratta dell’appuntamento annuale gratuito, creato dalla community di RHC, per far accrescere l’interesse verso le tecnologie digitali, l’innovazione digitale e la consapevolezza del rischio informatico.

La giornata inizierà alle 9:30 (con accoglienza dalle 9:00) e sarà interamente dedicata alla RHC Conference, un evento di spicco nel campo della sicurezza informatica. Il programma prevede un panel con ospiti istituzionali che si terrà all’inizio della conferenza. Successivamente, numerosi interventi di esperti nazionali nel campo della sicurezza informatica si susseguiranno sul palco fino alle ore 19:00 circa, quando termineranno le sessioni. Prima del termine della conferenza, ci sarà la premiazione dei vincitori della Capture The Flag prevista per le ore 18:00.
Potete iscrivervi gratuitamente all'evento utilizzando questo link.

Per ulteriori informazioni, scrivi a [email protected] oppure su Whatsapp al 379 163 8765


Supporta RHC attraverso:


Ti piacciono gli articoli di Red Hot Cyber? Non aspettare oltre, iscriviti alla newsletter settimanale per non perdere nessun articolo.

Vulnerability Summary: NetScaler ADC and NetScaler Gateway have the following vulnerabilities:

  • CVE-2024-5491: Denial of Service vulnerability affecting ADC or Gateway appliances configured with SNMP (NSIP/SNIP).
    • CWE: Improper restriction of operations within the bounds of a memory buffer
    • CVSS v4.0 Base Score: 7.1
  • CVE-2024-5492: Open redirect vulnerability allowing a remote, unauthenticated attacker to redirect users to arbitrary websites.
    • CWE: URL redirection to untrusted sites (‘Open Redirect’)
    • CVSS v4.0 Base Score: 5.1

Recommended Actions for Customers: Cloud Software Group strongly advises affected customers of NetScaler ADC and NetScaler Gateway to immediately install the relevant updated versions:

  • NetScaler ADC and NetScaler Gateway version 14.1-25.53 and later
  • NetScaler ADC and NetScaler Gateway version 13.1-53.17 and later for 13.1
  • NetScaler ADC and NetScaler Gateway version 13.0-92.31 and later for 13.0
  • NetScaler ADC version 13.1-FIPS 13.1-37.183 and later
  • NetScaler ADC version 12.1-FIPS 12.1-55.304 and later
  • NetScaler ADC version 12.1-NDcPP 12.1-55.304 and later

Cloud Software Group would like to express gratitude to Nanyu Zhong of VARAS@IIE and Mauro Dini for their valuable contributions in ensuring the security of Citrix customers.

Meanwhile, Citrix is actively informing its customers and partners about these critical security issues through a bulletin published on the Citrix Knowledge Center, accessible at the following address: https://support.citrix.com/securitybulletins.

Redazione
The editorial team of Red Hot Cyber consists of a group of individuals and anonymous sources who actively collaborate to provide early information and news on cybersecurity and computing in general.

Lista degli articoli
Categories
Banner

Editorial board : [email protected]

Facebook Linkedin Youtube Telegram Twitter Pinterest Tumblr
Redhotcyber is an open-news project that was launched in 2019 and subsequently expanded into a network of individuals collaborating to disseminate information and topics focused on technology, Information Technology, and cybersecurity. Its goal is to increase risk awareness among an ever-growing number of people.