[German]Administrators of a Citrix NetScaler ADC or a Citrix NetScaler Gateway should take action. Manufacturer Citrix has published a security advisory regarding the two vulnerabilities CVE-2023-6548 and CVE-2023-6549 in the above-mentioned products on January 16, 2024. One vulnerability allows DDoS attacks, while the second vulnerability allows authenticated (low privileged) remote code execution on the management interface.
Advertising
I became aware of the issue via the following tweet from Thorsten E. Citrix has published this security advisory with details on the vulnerabilities CVE-2023-6548 and CVE-2023-6549 in NetScaler ADC and NetScaler Gateway.
Regarding the vulnerabilities, Citrix provides the following explanations about their characteristics:
- CVE-2023-6548: Authenticated (low privileged) remote code execution on the management interface; Access to NSIP, CLIP or SNIP with access to the management interface, CVSS 5.5.
- CVE-2023-6549: Denial of Service, Denial of Service; the oAppliance must be configured as a gateway (virtual VPN server, ICA proxy, CVPN, RDP proxy) or virtual AAA server, CVSS 8.2.
The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-12.35
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-51.15
- NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.21
- NetScaler ADC 13.1-FIPS before 13.1-37.176
- NetScaler ADC 12.1-FIPS before 12.1-55.302
NetScaler ADC 12.1-NDcPP before 12.1-55.302etzt End Of Life (EOL) und anfällig. Dieses Bulletin gilt nur für vom Kunden verwaltete NetScaler ADC- und NetScaler Gateway-Produkte. Kunden, die von Citrix verwaltete Cloud-Dienste oder von Citrix verwaltete Adaptive Authentication verwenden, müssen keine Maßnahmen ergreifen. Im Citrix-Beitrag sind die Versionen der Software genannt, in denen die Schwachstellen beseitigt wurden.
Advertising
- NetScaler ADC and NetScaler Gateway 14.1-12.35 and later versions
- NetScaler ADC and NetScaler Gateway 13.1-51.15 and later versions of 13.1
- NetScaler ADC and NetScaler Gateway 13.0-92.21 and later versions of 13.0
- NetScaler ADC 13.1-FIPS 13.1-37.176 and later versions of 13.1-FIPS
- NetScaler ADC 12.1-FIPS 12.1-55.302 and later versions of 12.1-FIPS
- NetScaler ADC 12.1-NDcPP 12.1-55.302 and later versions of 12.1-NDcPP
Customers with a NetScaler ADC and the NetScaler Gateway in version 12.1 must upgrade to a successor version to continue to be protected against the vulnerability.
Advertising
