Citrix Tells Everyone Not To Worry Too Much Over Its Latest Security Patches. NSA’s Former Top Hacker Disagrees

Citrix has issued patches for 11 CVE-listed security vulnerabilities in its various networking products.

The bundle includes fixes for one code injection bug, three information disclosure flaws, three elevation of privilege bugs, two cross-site scripting vulnerabilities, one denial-of-service hole, and one authorization-bypass flaw.

Affected gear includes the Citrix Application Delivery Controller (ADC), Citrix Gateway, and Citrix SD-WAN WANOP. So far there have been no reports of any of the bugs being targeted in the wild, though Rob Joyce, former head of the NSA’s Tailored Access Operations elite hacking team, warns it’s time for admins to get busy – and so soon after patches emerged for vulns in F5 and Palo Alto networking gear.

Citrix flaw. Feeling like the boy that cried wolf, but really…. 3rd in a string of “must patch” vulnerabilities. Get the latest patches to ensure protection from several exploitable issues including unauthenticated access and RCE. https://t.co/0XLgPO9aML

— Rob Joyce (@RGB_Lights) July 7, 2020

The code injection flaw, CVE-2020-8194, is interesting. According to Citrix, an unauthenticated remote attacker can somehow present to a potential victim a downloadable malicious executable file from the gateway’s IP address. If the mark fetches the file and runs it, thinking it’s a legit application file from their networking gear, they now have malicious code running on their local PC. No other details on this cryptic flaw are known right now.

Meanwhile, those who rely on Linux PCs will want to check out CVE-2020-8199, a flaw in the Citrix Gateway Plugin for Linux that can be exploited by a rogue user or malware already on the system to elevate its privileges and cause more damage.

On the more likely-to-be-targeted end of things, there is CVE-2020-8187. That is a denial-of-service flaw in Citrix ADC and Citrix Gateway 12.0 or 11.1. The flaw can be remotely exploited without authentication.

Administrators will also want to pay close attention to CVE-2020-8198. That cross site scripting bug can be exploited externally without authentication, but requires the target to be logged into the vulnerable device as an admin. This, in other words, would be useful for a targeted attack against the folks that control all the systems.

Another cross-site-scripting flaw, CVE-2020-8191, only requires the victim to open a link while on the same network as a vulnerable gateway, so that one could be a wider issue.

The other bugs mainly require the attacker to already be logged into the device. They include CVE-2020-8195 and CVE-2020-8196 (information disclosure) and CVE-2020-8197. While not as hair-raising as bugs that are remotely exploitable without authentication, an attacker who had simply gained a foothold on one device could use these flaws to get further control and access, so they are definitely worth patching sooner rather than later.

Looking to avoid a repeat of the Christmas security crisis, when a remote code execution bug was disclosed in ADC and Gateway, Citrix made a point of trying to calm the nerves of admins by bringing out CISO Fermin Serna to explain that none of the bugs are as serious, or as easily exploited, as the infamous CVE-2019-19781 “Shitrix” vulnerability in December.

“There are barriers to many of these attacks; in particular, for customers where there is no untrustworthy traffic on the management network, the remaining risk reduces to a denial-of-service attack. And in that case, only when Gateway or authentication virtual servers are being used,” noted Serna.

“Other virtual servers, for example, load balancing and content switching virtual servers, are not affected by the issue.”

Others, with a lot of experience, may disagree. ®

READ MORE HERE