Citrix published on May, 9th a new Security Bulletin for NetScaler ADC and Netscaler Gateway. The severity is rated as medium. AXACOM is recommending to upgrade the NetScaler ADCs and Gateways in the next few days according to the Citrix CTX477714.
Please monitor as well the Citrix CTX article under the following link:
Vulnerabilities have been discovered in Citrix ADC and Citrix Gateway listed below, that, if exploited, could result in the following security issues:
Impacted Products, Versions and Components
The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability:
Citrix ADC and Citrix Gateway 13.1 before 13.1-45.61
Citrix ADC and Citrix Gateway 13.0 before 13.0-90.11
Citrix ADC and Citrix Gateway 12.1 before 12.1-65.35
Citrix ADC 12.1-FIPS before 12.1-55.296
Citrix ADC 12.1-NDcPP before 12.1-55.296
This bulletin only applies to customer-managed Citrix ADC and Citrix Gateway. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action.
CVE ID
Description
Pre-requisites
CWE
CVSS
CVE-2023-24488
Cross site scripting
Appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Affected customers of Citrix ADC and Citrix Gateway are recommended to install the relevant updated versions of Citrix ADC or Citrix Gateway as soon as possible:
Citrix ADC and Citrix Gateway 13.1-45.61 and later releases
Citrix ADC and Citrix Gateway 13.0-90.11 and later releases of 13.0
Citrix ADC and Citrix Gateway 12.1-65.35 and later releases of 12.1
Citrix ADC 12.1-FIPS 12.1-55.296 and later releases of 12.1-FIPS
Citrix ADC 13.1-FIPS 13.1-37.150 and later releases of 13.1-FIPS
Citrix ADC 12.1-NDcPP 12.1-55.296 and later releases of 12.1-NDcPP
Kunden, die auf ihrem NetScaler Kerberos verwenden, bekommen nach dem Microsoft November Update ein Problem. Kerberos funktioniert danach nicht mehr mit dem NetScaler und auch weitere Umsysteme sind davon betroffen. Sie erhalten bei einem Login Versuch via NetScaler folgenden Eintrag im System Eventlog des Domain Controllers:
While processing an AS request for target service <service>, the account <account name> did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 1). The requested etypes : 18 3. The accounts available etypes : 23 18 17. Changing or resetting the password of <account name> will generate a proper key.
ACHTUNG: Diese Anpassungen sind nur als Workaround zu verstehen und sollten wieder rückgängig gemacht werden, sobald Microsoft einen Fix für den Fehler bereitstellt!
UPDATE 18.11.2022
Microsoft hat ein OOB Update für Domain Controller veröffentlicht, welches das oben beschriebene Problem löst.
Nach der Installation des Updates auf allen Domain Controllern ist es möglich RC4 wieder vom KCD Account zu entfernen (Attribut: msDS-SupportedEncryptionTypes, Value: 24) und falls gesetzt, den Reg Key «KrbtgtFullPacSignature» wieder zu entfernen.
Vulnerabilities have been discovered in Citrix Gateway and Citrix ADC, listed below. Note that only appliances that are operating as a Gateway (appliances using the SSL VPN functionality or deployed as an ICA proxy with authentication enabled) are affected by the first issue, which is rated as a Critical severity vulnerability.
CVE-ID
Description
CWE
Affected Products
Pre-conditions
CVE-2022-27510
Unauthorized access to Gateway user capabilities
CWE-288: Authentication Bypass Using an Alternate Path or Channel
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway)
CVE-2022-27513
Remote desktop takeover via phishing
CWE-345: Insufficient Verification of Data Authenticity
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway) and the RDP proxy functionality must be configured
CVE-2022-27516
User login brute force protection functionality bypass
CWE-693: Protection Mechanism Failure
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway) OR AAA virtual server and the user lockout functionality “Max Login Attempts” must be configured
The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability:
Citrix ADC and Citrix Gateway 13.1 before 13.1-33.47
Citrix ADC and Citrix Gateway 13.0 before 13.0-88.12
Citrix ADC and Citrix Gateway 12.1 before 12.1.65.21
Citrix ADC 12.1-FIPS before 12.1-55.289
Citrix ADC 12.1-NDcPP before 12.1-55.289
This bulletin only applies to customer-managed Citrix ADC and Citrix Gateway appliances. Customers using Citrix-managed cloud services do not need to take any action.
A vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows). If exploited, this issue would allow an adversary, who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM. This issue has the following identifier:
CVE-ID
Description
CWE
Pre-conditions
CVE-2022-21827
Arbitrary corruption or deletion of files as SYSTEM
CWE-284: Improper Access Control
Local access to a machine that has the vulnerable plug-in installed
The following supported versions of Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) are affected by this vulnerability:
Citrix Gateway Plug-in for Windows versions before 21.9.1.2
What Customers Should Do
This issue has been addressed in the following versions of Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows):
Citrix Gateway Plug-in for Windows version 21.9.1.2 and later releases
Nach Update des Chrome oder chromium basierende Browser auf die Version 100.0.4896.60 bekommen User nach der Anmeldung am Citrix Gateway ein «spinning circle» und nicht die published Apps angezeigt. Das Problem tritt aufgrund einer Inkompatibilität mit den Citrix ADC Custom Themes auf.
Betroffen ist die Citrix ADC/Gateway Version 13.0 83.29
Systeme mit Citrix ADC/Gateway Version 13.1 12.50 und höher sind nicht betroffen. Ebenfalls nicht betroffen sind Firefox, Apple Safari Browser und ältere Chrome/Chromium Browser.
