{"id":12765,"date":"2020-01-24T00:15:00","date_gmt":"2020-01-23T23:15:00","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=12765"},"modified":"2020-03-27T05:46:02","modified_gmt":"2020-03-27T04:46:02","slug":"citrix-vulnerability-new-updates-and-scanners-for-testing","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2020\/01\/24\/citrix-vulnerability-new-updates-and-scanners-for-testing\/","title":{"rendered":"Citrix vulnerability: New updates and scanners for testing"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline;\" src=\"https:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2015\/01\/Schutz.jpg\" width=\"40\" height=\"47\" \/>[<a href=\"https:\/\/www.borncity.com\/blog\/?p=227381\" target=\"_blank\" rel=\"noopener noreferrer\">German<\/a>]Citrix developers have now released further firmware updates to close the vulnerabilities reported before Christmas 2019. There is also a scanner to detect Citrix systems compromised via the CVE-2019-19781 vulnerability. And there is a critical vulnerability in Cisco Firepower.<\/p>\n<p><!--more--><\/p>\n<h2>Citrix vulnerability CVE-2019-19781<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/vg05.met.vgwort.de\/na\/7f89a34e6011495b820beef1c20b18e5\" alt=\"\" width=\"1\" height=\"1\" \/>A vulnerability (<a href=\"https:\/\/support.citrix.com\/article\/CTX267027\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2019-19781<\/a>) exists in the Citrix Application Delivery Controller (ADC), formerly NetScaler ADC, and in Citrix Gateway, formerly NetScaler Gateway, that could allow attackers to execute unwanted code. If this vulnerability is exploited, attackers can gain direct access to the corporate local network from the Internet. This attack does not require access to any accounts and therefore can be executed by any remote attacker. I first reported the vulnerability in Citrix products before Christmas 2019 in the blog post <a href=\"https:\/\/borncity.com\/win\/2019\/12\/24\/schwachstelle-in-citrix-produkten-gefhrdet-firmen-netzwerke\/\">Vulnerability in Citrix Apps put companies at risk<\/a>.<\/p>\n<h2>Firmware updates for Citrix products<\/h2>\n<p>The first firmware update for the Citrix ADC\/Netscaler 11.1\/12.0 was released on January 19, 2020, and Citrix has also published a blog entry on the topic of\u00a0 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/citrix-patches-cve-2019-19781-flaw-in-citrix-adc-111-and-120\/\" target=\"_blank\" rel=\"noopener noreferrer\">Vulnerability Update: First permanent fixes available, timeline accelerated<\/a>. Permanent fixes for the ADC versions 11.1 and 12.0 are available for download <a href=\"https:\/\/web.archive.org\/web\/20200302000016\/https:\/\/www.citrix.com\/downloads\/citrix-adc\/firmware\/release-111-build-6315.html\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a> and <a href=\"https:\/\/www.citrix.com\/downloads\/citrix-adc\/firmware\/release-120-build-6313.html\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a>.<\/p>\n<p>I had reported patches for Citrix ADC\/Netscaler 11.1\/12.0 available (19.1.2020) in the blog post <a href=\"https:\/\/borncity.com\/win\/2020\/01\/20\/citrix-adc-netscaler-patches-11-1-12-0-released-01-19-2020\/\">Citrix ADC\/Netscaler patches 11.1\/12.0 released (01\/19\/2020)<\/a>, for more details see the <a href=\"https:\/\/www.citrix.com\/blogs\/2020\/01\/19\/vulnerability-update-first-permanent-fixes-available-timeline-accelerated\/\" target=\"_blank\" rel=\"noopener noreferrer\">Citrix blog post<\/a>. There the release dates and the versions for the updates are listed.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p dir=\"ltr\" lang=\"en\">The permanent security patch \/ firmware for <a href=\"https:\/\/twitter.com\/citrix?ref_src=twsrc%5Etfw\">@Citrix<\/a> CVE-2019-19781 is now available for all versions: 11.0, 11.1, 12.0, 12.1 and 13.0 Happy updating! <a href=\"https:\/\/t.co\/q0PNaR8EpL\">https:\/\/t.co\/q0PNaR8EpL<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/CitrixADC?src=hash&amp;ref_src=twsrc%5Etfw\">#CitrixADC<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/NetScalerRocks?src=hash&amp;ref_src=twsrc%5Etfw\">#NetScalerRocks<\/a> <a href=\"https:\/\/t.co\/V2vkp0E0If\">pic.twitter.com\/V2vkp0E0If<\/a><\/p>\n<p>\u2014 Anton van Pelt (@AntonvanPelt) <a href=\"https:\/\/twitter.com\/AntonvanPelt\/status\/1220456252096106496?ref_src=twsrc%5Etfw\">January 23, 2020<\/a><\/p><\/blockquote>\n<p><span id=\"preservecc0d9f5f3a76449f8b98dac7607e4761\" class=\"wlWriterPreserve\"><script src=\"https:\/\/platform.twitter.com\/widgets.js\" async=\"\" charset=\"utf-8\"><\/script><\/span><\/p>\n<p>According to the above tweet, firmware updates for all versions 11.0, 11.1, 12.0, 12.1 and 13.0 of the Citrix ADC are now released. In addition, firmware updates have <a href=\"https:\/\/www.citrix.com\/blogs\/2020\/01\/22\/update-on-cve-2019-19781-fixes-now-available-for-citrix-sd-wan-wanop\/\" target=\"_blank\" rel=\"noopener noreferrer\">been released<\/a> for the versions of Citrix SD-WAN WANOP affected by the <a href=\"https:\/\/support.citrix.com\/article\/CTX267027\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2019-19781<\/a> vulnerability. The fixes are available <a href=\"https:\/\/www.citrix.com\/downloads\/citrix-sd-wan\/\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a>. Administrators should install the updates immediately.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p dir=\"ltr\" lang=\"en\">Citrix Releases Final Patch as Ransomware Attacks Ramp Up &#8211; by <a href=\"https:\/\/twitter.com\/serghei?ref_src=twsrc%5Etfw\">@serghei<\/a><a href=\"https:\/\/t.co\/DqMpT3oGHo\">https:\/\/t.co\/DqMpT3oGHo<\/a><\/p>\n<p>\u2014 BleepingComputer (@BleepinComputer) <a href=\"https:\/\/twitter.com\/BleepinComputer\/status\/1220800375269339137?ref_src=twsrc%5Etfw\">January 24, 2020<\/a><\/p><\/blockquote>\n<p><script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<strong>Addendum: <\/strong>According to the above tweet, Citrix has now released updates for all Citrix products affected by the vulnerability.<\/p>\n<h2>Scanner to detect hacked Citrix systems<\/h2>\n<p>The problem is that Citrix provided a workaround but no patch to close the vulnerability after it was disclosed. Many Citrix ADC\/Netscaler have been 'open' for over a month and may already have been compromised by malware.<\/p>\n<p>Citrix has released a scanner these days to scan for compromised Citrix devices. The whole thing is a shell script that is available <a href=\"https:\/\/github.com\/citrix\/ioc-scanner-CVE-2019-19781\/releases\" target=\"_blank\" rel=\"noopener noreferrer\">on GitHub<\/a> and should run directly on the appliances. Bleeping Computer has <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/citrix-releases-scanner-to-detect-hacked-citrix-adc-appliances\/\" target=\"_blank\" rel=\"noopener noreferrer\">an article<\/a> about that scanner.<\/p>\n<h2>CVE-2019-16028 vulnerability in Cisco Firepower<\/h2>\n<p><a href=\"https:\/\/www.cisco.com\/c\/de_de\/products\/security\/firewalls\/index.html\" target=\"_blank\" rel=\"noopener noreferrer\">Cisco Firepower<\/a> is a firewall designed to detect security breaches and stop threats. However, there is a CVE-2019-16028 vulnerability in LDAP authentication, which Cisco has identified as critical, that <a href=\"https:\/\/tools.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-20200122-fmc-auth\" target=\"_blank\" rel=\"noopener noreferrer\">Cisco is warning about<\/a>. A vulnerability in the Cisco Firepower Management Center (FMC) web-based management interface could allow an unauthenticated remote attacker to bypass authentication and perform arbitrary actions with administrative privileges on an affected device.<\/p>\n<p>The vulnerability is due to improper handling of Lightweight Directory Access Protocol (LDAP) authentication responses from an external authentication server. An attacker could exploit this vulnerability by sending finished HTTP requests to an affected device. A successful attack could allow the attacker to gain administrative access to the affected device's Web-based management interface. Cisco has issued a software update to close this vulnerability.<\/p>\n<p><strong>Similar articles:<\/strong><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2019\/12\/24\/schwachstelle-in-citrix-produkten-gefhrdet-firmen-netzwerke\/\">Vulnerability in Citrix Apps put companies at risk<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2020\/01\/13\/poc-for-citrix-adc-netscaler-vulnerability-cve-2019-19781\/\">PoC for Citrix ADC\/Netscaler vulnerability CVE-2019-19781<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2020\/01\/17\/further-actions-required-for-citrix-netscaler-vulnerability\/\">Further actions required for Citrix Netscaler vulnerability<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2020\/01\/20\/citrix-adc-netscaler-patches-11-1-12-0-released-01-19-2020\/\">Citrix ADC\/Netscaler patches 11.1\/12.0 released (01\/19\/2020)<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>[German]Citrix developers have now released further firmware updates to close the vulnerabilities reported before Christmas 2019. There is also a scanner to detect Citrix systems compromised via the CVE-2019-19781 vulnerability. And there is a critical vulnerability in Cisco Firepower.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,1547,22],"tags":[69,1544,195],"class_list":["post-12765","post","type-post","status-publish","format-standard","hentry","category-security","category-software","category-update","tag-security","tag-software","tag-update"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/12765","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=12765"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/12765\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=12765"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=12765"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=12765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}