Affected gear includes the Citrix Application Delivery Controller (ADC), Citrix Gateway, and Citrix SD-WAN WANOP. So far there have been no reports of any of the bugs being targeted in the wild, though Rob Joyce, former head<\/a> of the NSA’s Tailored Access Operations elite hacking team, warns it’s time for admins to get busy \u2013 and so soon after patches emerged for vulns in F5<\/a> and Palo Alto<\/a> networking gear.<\/p>\n Citrix flaw. Feeling like the boy that cried wolf, but really…. 3rd in a string of \u201cmust patch\u201d vulnerabilities. Get the latest patches to ensure protection from several exploitable issues including unauthenticated access and RCE. https:\/\/t.co\/0XLgPO9aML<\/a><\/p>\n \u2014 Rob Joyce (@RGB_Lights) July 7, 2020<\/a><\/p><\/blockquote>\n The code injection flaw, CVE-2020-8194, is interesting. According to Citrix, an unauthenticated remote attacker can somehow present to a potential victim a downloadable malicious executable file from the gateway’s IP address. If the mark fetches the file and runs it, thinking it’s a legit application file from their networking gear, they now have malicious code running on their local PC. No other details on this cryptic flaw are known right now.<\/p>\n Meanwhile, those who rely on Linux PCs will want to check out CVE-2020-8199, a flaw in the Citrix Gateway Plugin for Linux that can be exploited by a rogue user or malware already on the system to elevate its privileges and cause more damage.<\/p>\n On the more likely-to-be-targeted end of things, there is CVE-2020-8187. That is a denial-of-service flaw in Citrix ADC and Citrix Gateway 12.0 or 11.1. The flaw can be remotely exploited without authentication.<\/p>\n Administrators will also want to pay close attention to CVE-2020-8198. That cross site scripting bug can be exploited externally without authentication, but requires the target to be logged into the vulnerable device as an admin. This, in other words, would be useful for a targeted attack against the folks that control all the systems.<\/p>\n READ MORE<\/span><\/a><\/div>\n Another cross-site-scripting flaw, CVE-2020-8191, only requires the victim to open a link while on the same network as a vulnerable gateway, so that one could be a wider issue.<\/p>\n The other bugs mainly require the attacker to already be logged into the device. They include CVE-2020-8195 and CVE-2020-8196 (information disclosure) and CVE-2020-8197. While not as hair-raising as bugs that are remotely exploitable without authentication, an attacker who had simply gained a foothold on one device could use these flaws to get further control and access, so they are definitely worth patching sooner rather than later.<\/p>\n Looking to avoid a repeat of the Christmas security crisis, when a remote code execution bug<\/a> was disclosed in ADC and Gateway, Citrix made a point of trying to calm the nerves of admins by bringing out CISO Fermin Serna to explain that none of the bugs are as serious, or as easily exploited, as the infamous CVE-2019-19781 “Shitrix” vulnerability in December.<\/p>\n “There are barriers to many of these attacks; in particular, for customers where there is no untrustworthy traffic on the management network, the remaining risk reduces to a denial-of-service attack. And in that case, only when Gateway or authentication virtual servers are being used,” noted<\/a> Serna.<\/p>\n “Other virtual servers, for example, load balancing and content switching virtual servers, are not affected by the issue.”<\/p>\n Others, with a lot of experience, may disagree. \u00ae<\/p>\n\n
![\"Australian](\"https:\/\/regmedia.co.uk\/2020\/06\/19\/scomo.jpg?x=174&y=115&crop=1\")
<\/p>\nAustralian PM says nation under serious state-run ‘cyber attack’ \u2013 Microsoft, Citrix, Telerik UI bugs ‘exploited’<\/h2>\n