CERT-In Vulnerability Note
CIVN-2020-0002
Remote Code Execution Vulnerability in Citrix Products
Original Issue Date:January 06, 2020
Severity Rating: HIGH
Component Affected
- Citrix Application Delivery Controller(ADC) and Citrix Gateway version 13.0
- Citrix Application Delivery Controller(ADC) and NetScaler Gateway version 12.1
- Citrix Application Delivery Controller(ADC) and NetScaler Gateway version 12.0
- Citrix Application Delivery Controller(ADC) and NetScaler Gateway version 11.1
- Citrix NetScaler Application Delivery Controller(ADC) and NetScaler Gateway version 10.5
Overview
A vulnerability has been reported in Citrix Application Delivery Controller and Citrix Gateway which could allow a remote attacker to execute arbitrary code on a targeted system.
Description
The vulnerability exists in Citrix ADC and Citrix Gateway due to improper handling of HTTP based VPN requests. A remote attacker may exploit this vulnerability by sending a crafted web request to the affected systems.
Successful exploitation of the vulnerability could allow the attacker to execute arbitrary code on the targeted system.
Solution
Apply appropriate mitigation steps as mentioned in the following link:
https://support.citrix.com/article/CTX267679
Vendor Information
Citrix Systems
https://support.citrix.com/article/CTX267679
References
Symantec
https://www.symantec.com/security-center/vulnerabilities/writeup/111238
SANS
https://www.sans.org/webcasts/about-critical-citrix-gateway-netscaler-vulnerability-cve-2019-19781-112990
CVE Name
CVE-2019-19781
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|