Windows Virtual Delivery Agent for CVAD and Citrix DaaS Security Bulletin CVE-2024-6151
Security Bulletin | Severity: High | Created: 09 Jul 2024 | Modified: 09 Jul 2024 | Status: Final
Applicable Products
Citrix Virtual Apps and Desktops
Description of Problem
A vulnerability has been identified that impacts Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS. Refer to below for further details:
Affected Versions
The vulnerability affects the following supported versions of Windows Virtual Delivery Agent:
Current Release (CR)
Citrix Virtual Apps and Desktops versions before 2402
Long Term Service Release (LTSR)
Citrix Virtual Apps and Desktops 1912 LTSR before CU9
Citrix Virtual Apps and Desktops 2203 LTSR before CU5
Summary
Windows Virtual Delivery Agent contains the vulnerability mentioned below
CVE ID
Description
Pre-requisites
CWE
CVSS
CVE-2024-6151
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
Local access to the target system
CWE-269: Improper Privilege Management
CVSS v4.0 Base Score: 8.5(CVS:4.0/AV:L/AV:L/AT:N/PR:L/UI:N/VCH/VI:H/VA:H/SC:N/S:N/S:N)
What Customers Should Do
Citrix strongly recommends that customers upgrade their Windows Virtual Delivery Agent to versions that contain the fixes as soon as possible.
Windows Virtual Delivery Agent versions that contain the fixes are:
Current Release (CR)
Citrix Virtual Apps and Desktops 2402 and later versions
Long Term Service Release (LTSR)
Citrix Virtual Apps and Desktops 1912 LTSR CU9 and later cumulative updates
Citrix Virtual Apps and Desktops 2203 LTSR CU5 and later cumulative updates
Two vulnerabilities have been discovered in NetScaler Console (formerly NetScaler ADM), NetScaler SVM, and NetScaler Agent. Refer to below for further details:
Affected Versions
The following supported version of NetScaler Console (formerly NetScaler ADM) is affected by CVE-2024-6235:
NetScaler Console 14.1 before 14.1-25.53
The following supported versions of NetScaler Console, NetScaler Agent and NetScaler SVM are affected by CVE-2024-6236:
NetScaler Console 14.1 before 14.1-25.53
NetScaler Console 13.1 before 13.1-53.22
NetScaler Console 13.0 before 13.0-92.31
NetScaler SVM 14.1 before 14.1-25.53
NetScaler SVM 13.1 before 13.1-53.17
NetScaler SVM 13.0 before 13.0-92.31
NetScaler Agent 14.1 before 14.1-25.53
NetScaler Agent 13.1 before 13.1-53.22
NetScaler Agent 13.0 before 13.0-92.31
This bulletin only applies to the customer-managed NetScaler Console. Customers using Citrix-managed NetScaler Console Service do not need to take any action.
Summary
NetScaler Console contains the vulnerabilities mentioned below
CVE ID
Description
Pre-requisites
Affected Products
CWE
CVSS
CVE-2024-6235
Sensitive information disclosure
Access to NetScaler Console IP
NetScaler Console
CWE-287: Improper Authentication
CVSS v4.0 Base Score: 9.4(CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
CVE-2024-6236
Denial of Service
Access to NetScaler Console IP, NetScaler Agent IP, SVM IP
NetScaler Console, NetScaler Agent, NetScaler SVM
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 7.1(CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
What Customers Should Do
Cloud Software Group strongly urges customers of NetScaler Console to install the relevant updated versions of NetScaler Console as soon as possible:
NetScaler Console 14.1-25.53 and later releases of 14.1
NetScaler Console 13.1-53.22 and later releases of 13.1
NetScaler Console 13.0-92.31 and later releases of 13.0
NetScaler SVM 14.1-25.53 and later releases of 14.1
NetScaler SVM 13.1-53.17 and later releases of 13.1
NetScaler SVM 13.0-92.31 and later releases of 13.0
NetScaler Agent 14.1-25.53and later releases of 14.1
NetScaler Agent 13.1-53.22 and later releases of 13.1
NetScaler Agent 13.0-92.31and later releases of 13.0
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2024-5491 and CVE-2024-5492
Security Bulletin | Severity: High | Created: 09 Jul 2024 | Modified: 09 Jul 2024 | Status: Final
Applicable Products
NetScaler Gateway
NetScaler
Description of Problem
Two vulnerabilities have been discovered in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Refer to below for further details:
Affected Versions
The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities:
NetScaler ADC and NetScaler Gateway 14.1 before 14.1-25.53
NetScaler ADC and NetScaler Gateway 13.1 before 13.1-53.17
NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.31
NetScaler ADC 13.1-FIPS before 13.1-37.183
NetScaler ADC 12.1-FIPS before 12.1-55.304
NetScaler ADC 12.1-NDcPP before 12.1-55.304
Note: NetScaler ADC and NetScaler Gateway version 12.1 is now End Of Life (EOL) and is vulnerable. Customers are recommended to upgrade their appliances to one of the supported versions that address the vulnerabilities.
This bulletin only applies to customer-managed NetScaler ADC and NetScaler Gateway. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action.
Summary
NetScaler ADC and NetScaler Gateway contain the vulnerabilities mentioned below
CVE ID
Description
Pre-requisites
CWE
CVSS
CVE-2024-5491
Denial of Service
ADC or Gateway appliance configured with SNMP (NSIP/SNIP)
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 7.1(CVSS:4.0/AV:A/AC:L/AT:NÅR:N/UI:N/VCH:N/VI:L/VA:H/SC:N/S:N/S:N)
CVE-2024-5492
Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites
Requires targeted user to access an attacker-controlled URL while being on a network with access to NSIP
CWE-601: URL Redirection to Untrusted Site (‹Open Redirect›)
CVSS v4.0 Base Score: 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N)
What Customers Should Do
Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.
NetScaler ADC and NetScaler Gateway 14.1-25.53 and later releases
NetScaler ADC and NetScaler Gateway 13.1-53.17 and later releases of 13.1
NetScaler ADC and NetScaler Gateway 13.0-92.31 and later releases of 13.0
NetScaler ADC 13.1-FIPS 13.1-37.183 and later releases of 13.1-FIPS
NetScaler ADC 12.1-FIPS 12.1-55.304 and later releases of 12.1-FIPS
NetScaler ADC 12.1-NDcPP 12.1-55.304 and later releases of 12.1-NDcPP
Note: NetScaler ADC and NetScaler Gateway version 12.1 is now End Of Life (EOL). Customers are recommended to upgrade their appliances to one of the supported versions that address the vulnerabilities.
