ESB-2023.3910 – [Ubuntu] Citrix ADC and Gateway: CVSS (Max): 9.6 [auscert.org.au]

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2023.3910
Citrix Secure Access client for Ubuntu Security Bulletin for CVE-2023-24492
12 July 2023

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: Citrix ADC
Citrix Gateway
Publisher: Citrix
Operating System: Ubuntu
Resolution: Patch/Upgrade
CVE Names: CVE-2023-24492

Original Bulletin:
https://support.citrix.com/article/CTX564169/citrix-secure-access-client-for-ubuntu-security-bulletin-for-cve202324492

Comment: CVSS (Max): 9.6 CVE-2023-24492 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
CVSS Source: Citrix
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

– ————————–BEGIN INCLUDED TEXT——————–

Citrix Secure Access client for Ubuntu Security Bulletin for CVE-2023-24492

Reference: CTX564169
Category : Severity: Critical
Created : 11 July 2023
Modified : 11 July 2023

Applicable Products

o Citrix ADC
o Citrix Gateway

Description of Problem

Vulnerabilities have been discovered in Citrix Secure Access client for Ubuntu
(previously Citrix Gateway VPN client for Ubuntu).

The following supported versions are affected by the vulnerability:

o Versions before 23.5.2

The issue has the following identifier:

What Customers Should Do

This issue has been addressed in the following versions of Citrix Secure Access
client for Ubuntu:

o 23.5.2 and later releases

Citrix recommends that customers who are affected by the above vulnerability
upgrade the Citrix Secure Access client for Ubuntu installed on their endpoints
by taking the following actions as soon as possible:

1. If Citrix Secure Access client for Ubuntu is distributed via the SSL VPN
upgrade control feature of Citrix ADC or Citrix Gateway:

Check the versions of Citrix Secure Access client for Ubuntu that are being
distributed by each Citrix ADC or Citrix Gateway instance. This can be done by
viewing the file located at /var/netscaler/gui/vpn/scripts/linux/
clientversions.xml. If it is a vulnerable version, customers must:

o Replace the vulnerable client on the Citrix ADC or Gateway by following the
instructions at: https://docs.netscaler.com/en-us/citrix-gateway/
citrix-gateway-clients/secure-access-client-linux.html

Information about the upgrade control feature is detailed at: https://
docs.citrix.com/en-us/citrix-gateway/13/vpn-user-config/
how-users-connect-with-gateway-plugin.html#
control-upgrade-of-citrix-gateway-plug-ins

2. If Citrix Secure Access client is distributed/upgraded directly onto users’
devices:

Customers must install the above mentioned fixed client on their users’ devices
by downloading them from https://www.citrix.com/downloads/citrix-gateway/
plug-ins/Citrix-Gateway-VPN-EPA-Clients-Ubuntu.html

Acknowledgements

Citrix thanks Rilke Petrosky of F2TC Cyber Security for working with us to
protect Citrix customers.

What Citrix is Doing

Citrix is notifying customers and channel partners about this potential
security issue through the publication of this security bulletin on the Citrix
Knowledge Center at https://support.citrix.com/securitybulletins .

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix
Technical Support. Contact details for Citrix Technical Support are available
at https://www.citrix.com/support/open-a-support-case .

Subscribe to Receive Alerts

Citrix strongly recommends that all customers subscribe to receive alerts when
a Citrix security bulletin is created or modified at https://support.citrix.com
/user/alerts .

Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and considers any
and all potential vulnerabilities seriously. For details on our vulnerability
response process and guidance on how to report security-related issues to
Citrix, please see the following webpage: https://www.citrix.com/about/
trust-center/vulnerability-process.html .

Disclaimer

This document is provided on an “as is” basis and does not imply any kind of
guarantee or warranty, including the warranties of merchantability or fitness
for a particular use. Your use of the information on the document is at your
own risk. Citrix reserves the right to change or update this document at any
time. Customers are therefore recommended to always view the latest version of
this document directly from the Citrix Knowledge Center.

Changelog

2023-07-11 T 14:30:00Z Initial Publication
2023-07-11 T 15:00:00Z Fixed the CVE ID

– ————————–END INCLUDED TEXT——————–

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/

iQIVAwUBZK4v9MkNZI30y1K9AQjeFQ/7BeLH1ytPNJ2sA+0ylp+khvxmOMA27vih
jDF+5aJB2WYpAe+Pv/RTcrNTSaa0KOncH4tdeZSbO7z9XqcLW9ttwKNJH3JYeKr0
eyGQy60ZFtofJI+7T9C6p2GP5QOYW0DbUBkUTZJXjU0+6WwTssCPTdGjorIgtq99
0OEzajYs/Ub4dND9muH3GLiw9VK19anQ63I6M5AlYUiAZ//ESCEgZGVjHVl9BN/V
eL0Vnyp+q/CotMqWRywudzO0iTGCIs0yHqeCFTZePQT8HPTidDb43lO/fvnrZn/v
Dw4tOZLGPXiI/biwWhJzjNM0KxuNt1M1d0yDG941yQDbKHLVPsU7zkcI4rNWztUo
JomeeMzDmYVpnKWkuVy5YzCaMyXs7xDqecP5oJgXMqMdvDogR8/EXLKRDJuc6fCz
EJbie2zHp+uktWjCOWNlX2aQcE1T10PBuBbgIX5eIxwQ3R15envNNR9rZ8chqAW2
kN4GATc4qflHqbtQrl897uKe5e9LUSXPymf9DedQasL4a5/tOLPpIlsS41NQdaHX
eTOUUes15/ekR4DVL1B5U+Wvf9pNCc56x2prm5/w0RIfygXiln71eIxS+BuX7zEG
Uj4V+0duJZ/FXLsPD78rL+2pgOAmak1YJdTC7XTcH22q0maeJ4j30PSyHpZ3r5/W
PzYh8uGAHGE=
=hW82
—–END PGP SIGNATURE—–

Source: Read More

Security Bulletins

Leave a Comment Cancel reply