Two vulnerabilities have been discovered in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway)
The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities:
Note: NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are now End Of Life (EOL) and are vulnerable. Customers are recommended to upgrade their appliances to one of the supported versions that address the vulnerabilities.
| CVE-ID | Description | Pre-Requisites | CWE | Table CVSS |
|---|---|---|---|---|
| CVE-2024-8534 | Memory safety vulnerability leading to memory corruption and Denial of Service | The appliance must be configured as a Gateway (VPN Vserver) with RDP Feature enabled OR The appliance must be configured as a Gateway (VPN Vserver) and RDP Proxy Server Profile is created and set to Gateway (VPN Vserver) OR The appliance must be configured as a Auth Server (AAA Vserver) with RDP Feature enabled | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 8.4 CVSS:4.0/ AV:N/AC:L/AT:P/ PR:N/UI:N/ VC:L/ VI:H/ VA:H/ SC:N/ SI:N/ SA:L |
| CVE-2024-8535 | Authenticated user can access unintended user capabilities | The appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR The appliance must be configured as a Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend resources | CWE-440: Expected Behavior Violation | CVSS v4.0 Base Score: 5.8 (CVSS:4.0/ AV:N/ AC:L/ AT:P/PR:L/ UI:N/ VC:L/ VI:L/ VA:L/ SC:H/ SI:H/ SA:H) |
Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.
Note: NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are now End Of Life (EOL) and no longer supported. Customers are recommended to upgrade their appliances to one of the supported versions that address the vulnerabilities.
Customers can determine if they have an appliance configured as one of the following by inspecting their ns.conf file for the specified strings
enable ns feature.*rdpproxy
add vpn vserver
add rdp serverprofile <RDP_server_name>
add vpn vserver <vserver_name> -rdpServerProfileName <RDP_server_name>
enable ns feature.*rdpproxy
add authentication vserver
Customers can determine if they have an appliance configured as one of the following by inspecting their ns.conf file for the specified strings
add aaa kcdaccount
add aaa kcdaccount
In addition, upon upgrading to the fixed version, customers must perform the shell commands mentioned below:
nsapimgr_wr.sh -ys call=ns_aaa_flush_kerberos_tickets
Note: In case of High Availability (HA) or Cluster setup of the NetScaler appliances, the above operation should be performed after upgrading all the appliances.