Citrix Netscaler ADC and Gateway plagued by serious DOS and Open Redirect flaw

Redazione RHC : 9 July 2024 14:21

Two vulnerabilities have been identified in NetScaler ADC and NetScaler Gateway. Affected Versions: The following supported versions of NetScaler ADC and NetScaler Gateway are vulnerable:

These devices are widely used to enhance application performance and ensure controlled and secure access to sensitive data.

• NetScaler ADC and NetScaler Gateway 14.1 before version 14.1-25.53
• NetScaler ADC and NetScaler Gateway 13.1 before version 13.1-53.17
• NetScaler ADC and NetScaler Gateway 13.0 before version 13.0-92.31
• NetScaler ADC 13.1-FIPS before version 13.1-37.183
• NetScaler ADC 12.1-FIPS before version 12.1-55.304
• NetScaler ADC 12.1-NDcPP before version 12.1-55.304

Note: Version 12.1 of NetScaler ADC and NetScaler Gateway is now End Of Life (EOL) and therefore vulnerable. Customers are advised to upgrade their devices to supported versions.

Vulnerability Summary: NetScaler ADC and NetScaler Gateway have the following vulnerabilities:

• CVE-2024-5491: Denial of Service vulnerability affecting ADC or Gateway appliances configured with SNMP (NSIP/SNIP).
  • CWE: Improper restriction of operations within the bounds of a memory buffer
  • CVSS v4.0 Base Score: 7.1
• CVE-2024-5492: Open redirect vulnerability allowing a remote, unauthenticated attacker to redirect users to arbitrary websites.
  • CWE: URL redirection to untrusted sites (‘Open Redirect’)
  • CVSS v4.0 Base Score: 5.1

Recommended Actions for Customers: Cloud Software Group strongly advises affected customers of NetScaler ADC and NetScaler Gateway to immediately install the relevant updated versions:

• NetScaler ADC and NetScaler Gateway version 14.1-25.53 and later
• NetScaler ADC and NetScaler Gateway version 13.1-53.17 and later for 13.1
• NetScaler ADC and NetScaler Gateway version 13.0-92.31 and later for 13.0
• NetScaler ADC version 13.1-FIPS 13.1-37.183 and later
• NetScaler ADC version 12.1-FIPS 12.1-55.304 and later
• NetScaler ADC version 12.1-NDcPP 12.1-55.304 and later

Cloud Software Group would like to express gratitude to Nanyu Zhong of VARAS@IIE and Mauro Dini for their valuable contributions in ensuring the security of Citrix customers.

Meanwhile, Citrix is actively informing its customers and partners about these critical security issues through a bulletin published on the Citrix Knowledge Center, accessible at the following address: https://support.citrix.com/securitybulletins.

Redazione
The editorial team of Red Hot Cyber consists of a group of individuals and anonymous sources who actively collaborate to provide early information and news on cybersecurity and computing in general.

Lista degli articoli