A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
This vulnerability affects all currently supported versions of customer-managed ShareFile storage zones controller before version 5.11.24.
This bulletin only applies to customer-managed ShareFile storage zones controllers. Customers using ShareFile-managed storage zones in the cloud do not need to take any action.
The issue has been given the following identifier:
CVE ID
Affected Products
Description
Pre-requisites
CWE
CVSS
CVE-2023-24489
Citrix Content Collaboration
Improper resource control allows unauthenticated remote compromise
Network access to the ShareFile storage zones controller
All customer-managed ShareFile storage zones controllers versions prior to the latest version 5.11.24 have been blocked to protect our customers. Customers will be able to reinstate the storage zones controller once the update to 5.11.24 is applied.
Customers should shut down any machine that was running an affected version of the storage zones controller software.
Citrix has identified an isolated issue in which some customers experienced a crash condition after upgrading to the current build with HTTP/2 enabled.
What Product is Affected?
NetScaler appliance upgraded to version NS13.1 Build 45.63 or NS13.0 Build 90.11
*No other versions are impacted by this HTTP/2 issue.
Is there a workaround or fix?
Workaround: Disable http2 in the HTTP profile bound to the virtual server.
Fix: Engineering is working on a code fix and will update the ETA of the next build as soon as possible.
How to verify if http2 is enabled?
Run the following command from the CLI and verify if http2Direct Is reported as enabled.
> show run | grep http2
Example of output if enabled:
> set ns httpProfile <name of httpprofile> -http2 ENABLED -http2Direct ENABLED
Example of output if not enabled:
> set ns httpProfile <name of httpprofile> -http2 DISABLED -http2Direct DISABLED
How to disable http2 if enabled?
> set ns httpProfile <name of the httpprofile> -http2 DISABLED -http2Direct DISABLED
Citrix published on May, 9th a new Security Bulletin for NetScaler ADC and Netscaler Gateway. The severity is rated as medium. AXACOM is recommending to upgrade the NetScaler ADCs and Gateways in the next few days according to the Citrix CTX477714.
Please monitor as well the Citrix CTX article under the following link:
Vulnerabilities have been discovered in Citrix ADC and Citrix Gateway listed below, that, if exploited, could result in the following security issues:
Impacted Products, Versions and Components
The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability:
Citrix ADC and Citrix Gateway 13.1 before 13.1-45.61
Citrix ADC and Citrix Gateway 13.0 before 13.0-90.11
Citrix ADC and Citrix Gateway 12.1 before 12.1-65.35
Citrix ADC 12.1-FIPS before 12.1-55.296
Citrix ADC 12.1-NDcPP before 12.1-55.296
This bulletin only applies to customer-managed Citrix ADC and Citrix Gateway. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action.
CVE ID
Description
Pre-requisites
CWE
CVSS
CVE-2023-24488
Cross site scripting
Appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Affected customers of Citrix ADC and Citrix Gateway are recommended to install the relevant updated versions of Citrix ADC or Citrix Gateway as soon as possible:
Citrix ADC and Citrix Gateway 13.1-45.61 and later releases
Citrix ADC and Citrix Gateway 13.0-90.11 and later releases of 13.0
Citrix ADC and Citrix Gateway 12.1-65.35 and later releases of 12.1
Citrix ADC 12.1-FIPS 12.1-55.296 and later releases of 12.1-FIPS
Citrix ADC 13.1-FIPS 13.1-37.150 and later releases of 13.1-FIPS
Citrix ADC 12.1-NDcPP 12.1-55.296 and later releases of 12.1-NDcPP
Kunden, die auf ihrem NetScaler Kerberos verwenden, bekommen nach dem Microsoft November Update ein Problem. Kerberos funktioniert danach nicht mehr mit dem NetScaler und auch weitere Umsysteme sind davon betroffen. Sie erhalten bei einem Login Versuch via NetScaler folgenden Eintrag im System Eventlog des Domain Controllers:
While processing an AS request for target service <service>, the account <account name> did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 1). The requested etypes : 18 3. The accounts available etypes : 23 18 17. Changing or resetting the password of <account name> will generate a proper key.
ACHTUNG: Diese Anpassungen sind nur als Workaround zu verstehen und sollten wieder rückgängig gemacht werden, sobald Microsoft einen Fix für den Fehler bereitstellt!
UPDATE 18.11.2022
Microsoft hat ein OOB Update für Domain Controller veröffentlicht, welches das oben beschriebene Problem löst.
Nach der Installation des Updates auf allen Domain Controllern ist es möglich RC4 wieder vom KCD Account zu entfernen (Attribut: msDS-SupportedEncryptionTypes, Value: 24) und falls gesetzt, den Reg Key «KrbtgtFullPacSignature» wieder zu entfernen.
Vulnerabilities have been discovered in Citrix Gateway and Citrix ADC, listed below. Note that only appliances that are operating as a Gateway (appliances using the SSL VPN functionality or deployed as an ICA proxy with authentication enabled) are affected by the first issue, which is rated as a Critical severity vulnerability.
CVE-ID
Description
CWE
Affected Products
Pre-conditions
CVE-2022-27510
Unauthorized access to Gateway user capabilities
CWE-288: Authentication Bypass Using an Alternate Path or Channel
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway)
CVE-2022-27513
Remote desktop takeover via phishing
CWE-345: Insufficient Verification of Data Authenticity
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway) and the RDP proxy functionality must be configured
CVE-2022-27516
User login brute force protection functionality bypass
CWE-693: Protection Mechanism Failure
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway) OR AAA virtual server and the user lockout functionality “Max Login Attempts” must be configured
The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability:
Citrix ADC and Citrix Gateway 13.1 before 13.1-33.47
Citrix ADC and Citrix Gateway 13.0 before 13.0-88.12
Citrix ADC and Citrix Gateway 12.1 before 12.1.65.21
Citrix ADC 12.1-FIPS before 12.1-55.289
Citrix ADC 12.1-NDcPP before 12.1-55.289
This bulletin only applies to customer-managed Citrix ADC and Citrix Gateway appliances. Customers using Citrix-managed cloud services do not need to take any action.
