Threat alert details
We would like to bring your attention to a recent security bulletin surrounding Citrix Gateway and Citrix ADC. Vulnerabilities have been discovered in Citrix Gateway and Citrix ADC, listed below. Note that only appliances that are operating as a Gateway (appliances using the SSL VPN functionality or deployed as an ICA proxy with authentication enabled) are affected by the first issue, which is rated as a Critical severity vulnerability.
CVE |
Description |
Affected Products |
Pre-conditions |
Unauthorized access to Gateway user capabilities |
Citrix Gateway, Citrix ADC |
Appliance must be configured as a VPN (Gateway). |
|
Remote desktop takeover via phishing |
Citrix Gateway, Citrix ADC |
Appliance must be configured as a
and the RDP proxy functionality must be configured. |
|
User login brute force protection functionality bypass |
Citrix Gateway, Citrix ADC |
Appliance must be configured as a
OR
and the user lockout functionality “Max Login Attempts” must be configured |
Affected Products
The following versions of Citrix ADC and Citrix Gateway are affected
- Citrix ADC and Citrix Gateway 13.1 before 13.1-33.47
- Citrix ADC and Citrix Gateway 13.0 before 13.0-88.12
- Citrix ADC and Citrix Gateway 12.1 before 12.1.65.21
- Citrix ADC 12.1-FIPS before 12.1-55.289
- Citrix ADC 12.1-NDcPP before 12.1-55.289
Remediation
Affected customers of Citrix ADC and Citrix Gateway are recommended to install the relevant updated versions of Citrix ADC or Citrix Gateway as soon as possible:
- Citrix ADC and Citrix Gateway 13.1-33.47 and later releases
- Citrix ADC and Citrix Gateway 13.0-88.12 and later releases of 13.0
- Citrix ADC and Citrix Gateway 12.1-65.21 and later releases of 12.1
- Citrix ADC 12.1-FIPS 12.1-55.289 and later releases of 12.1-FIPS
- Citrix ADC 12.1-NDcPP 12.1-55.289 and later releases of 12.1-NDcPP
Please note that Citrix ADC and Citrix Gateway versions prior to 12.1 are EOL and customers on those versions are recommended to upgrade to one of the supported versions.
References
CovertSwarm welcomes Nick Dibbern as Chief Financial Officer
CovertSwarm has announced the appointment of Nick Dibbern as Chief Financial Officer, joining the executive team at a time of significant growth and bringing extensive experience…
James Dale joins CovertSwarm as Head of Adversarial Simulation Testing
CovertSwarm is proud to announce the appointment of James Dale as its new Head of Adversarial Simulation Testing.
CovertSwarm Achieves STAR-FS Accreditation
CovertSwarm has officially earned the prestigious STAR-FS (Simulated Target Attack & Response – Financial Services) accreditation from CREST.