NetScaler ADC and NetScaler Gateway vulnerabilities CVE-2023-6548 and CVE-2023-6549

Sicherheit (Pexels, allgemeine Nutzung)[German]Administrators of a Citrix NetScaler ADC or a Citrix NetScaler Gateway should take action. Manufacturer Citrix has published a security advisory regarding the two vulnerabilities CVE-2023-6548 and CVE-2023-6549 in the above-mentioned products on January 16, 2024. One vulnerability allows DDoS attacks, while the second vulnerability allows authenticated (low privileged) remote code execution on the management interface.


Advertising

I became aware of the issue via the following tweet from Thorsten E. Citrix has published this security advisory with details on the vulnerabilities CVE-2023-6548 and CVE-2023-6549 in NetScaler ADC and NetScaler Gateway.

Regarding the vulnerabilities, Citrix provides the following explanations about their characteristics:

  • CVE-2023-6548: Authenticated (low privileged) remote code execution on the management interface; Access to NSIP, CLIP or SNIP with access to the management interface, CVSS 5.5.
  • CVE-2023-6549: Denial of Service, Denial of Service; the oAppliance must be configured as a gateway (virtual VPN server, ICA proxy, CVPN, RDP proxy) or virtual AAA server, CVSS 8.2.

The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities:

  • NetScaler ADC and NetScaler Gateway 14.1 before 14.1-12.35
  • NetScaler ADC and NetScaler Gateway 13.1 before 13.1-51.15
  • NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.21
  • NetScaler ADC 13.1-FIPS before 13.1-37.176
  • NetScaler ADC 12.1-FIPS before 12.1-55.302

NetScaler ADC 12.1-NDcPP before 12.1-55.302etzt End Of Life (EOL) und anfällig. Dieses Bulletin gilt nur für vom Kunden verwaltete NetScaler ADC- und NetScaler Gateway-Produkte. Kunden, die von Citrix verwaltete Cloud-Dienste oder von Citrix verwaltete Adaptive Authentication verwenden, müssen keine Maßnahmen ergreifen. Im Citrix-Beitrag sind die Versionen der Software genannt, in denen die Schwachstellen beseitigt wurden.


Advertising

  • NetScaler ADC and NetScaler Gateway 14.1-12.35 and later versions
  • NetScaler ADC and NetScaler Gateway 13.1-51.15 and later versions of 13.1
  • NetScaler ADC and NetScaler Gateway 13.0-92.21 and later versions of 13.0
  • NetScaler ADC 13.1-FIPS 13.1-37.176 and later versions of 13.1-FIPS
  • NetScaler ADC 12.1-FIPS 12.1-55.302 and later versions of 12.1-FIPS
  • NetScaler ADC 12.1-NDcPP 12.1-55.302 and later versions of 12.1-NDcPP

Customers with a NetScaler ADC and the NetScaler Gateway in version 12.1 must upgrade to a successor version to continue to be protected against the vulnerability.


Cookies helps to fund this blog: Cookie settings
Advertising


This entry was posted in Security, Software and tagged , . Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *