—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3909
Citrix Secure Access client for Windows Security Bulletin
for CVE-2023-24491
12 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: Citrix ADC
Citrix Gateway
Publisher: Citrix
Operating System: Windows
Resolution: Patch/Upgrade
CVE Names: CVE-2023-24491
Original Bulletin:
https://support.citrix.com/article/CTX561480/citrix-secure-access-client-for-windows-security-bulletin-for-cve202324491
Comment: CVSS (Max): 7.8 CVE-2023-24491 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: Citrix
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
– ————————–BEGIN INCLUDED TEXT——————–
Citrix Secure Access client for Windows Security Bulletin for CVE-2023-24491
Reference: CTX561480
Category : Severity: High
Created : 11 July 2023
Modified : 11 July 2023
Applicable Products
o Citrix ADC
o Citrix Gateway
Description of Problem
A vulnerability has been discovered in the Citrix Secure Access client for
Windows.
The following supported versions are affected by the vulnerability:
o Versions before 23.5.1.3
The issue has the following identifier:
+————–+—————+—————————-+————+—-+
| CVE ID | Description | Pre-requisites | CWE |CVSS|
+————–+—————+—————————-+————+—-+
| |Local Privilege|Access to an endpoint with |Improper | |
|CVE-2023-24491|escalation to |Standard User Account that |Privilege |7.8 |
| |NT AUTHORITY |has the vulnerable client |Management | |
| |SYSTEM |installed |CWE-269 | |
+————–+—————+—————————-+————+—-+
What Customers Should Do
This issue has been addressed in the following versions of the Citrix Secure
Access client for Windows:
o 23.5.1.3 and later releases
Citrix recommends that customers who are affected by the above vulnerability
upgrade the Citrix Secure Access client for Windows installed on their
endpoints by taking the following actions as soon as possible:
1. If Citrix Secure Access client for Windows is distributed via the SSL VPN
upgrade control feature of Citrix ADC or Citrix Gateway:
Check the versions of the Citrix Secure Access client for Windows that are
being distributed by each Citrix ADC or Citrix Gateway instance. This can be
done using either GUI (instructions at: https://www.citrix.com/downloads/
citrix-gateway/plug-ins/citrix-secure-access-client-for-windows.html ) or by
viewing the file located at /var/netscaler/gui/vpn/pluginlist.xml. If it is a
vulnerable version, customers must:
o Replace the vulnerable client on the Citrix ADC or Citrix Gateway by
following the instructions at: https://www.citrix.com/downloads/
citrix-gateway/plug-ins/citrix-secure-access-client-for-windows.html .
Information about the upgrade control feature is detailed at: https://
docs.citrix.com/en-us/citrix-gateway/13/vpn-user-config/
how-users-connect-with-gateway-plugin.html#
control-upgrade-of-citrix-gateway-plug-ins
2. If the Citrix Secure Access client is distributed/upgraded directly onto
users’ devices:
Customers must install the above-mentioned fixed client on their users’ devices
by downloading them from https://www.citrix.com/downloads/citrix-gateway/
plug-ins/citrix-secure-access-client-for-windows.html
Acknowledgements
Citrix thanks Rilke Petrosky of F2TC Cyber Security for working with us to
protect Citrix customers.
What Citrix is Doing
Citrix is notifying customers and channel partners about this potential
security issue through the publication of this security bulletin on the Citrix
Knowledge Center at https://support.citrix.com/securitybulletins .
Obtaining Support on This Issue
If you require technical assistance with this issue, please contact Citrix
Technical Support. Contact details for Citrix Technical Support are available
at https://www.citrix.com/support/open-a-support-case .
Subscribe to Receive Alerts
Citrix strongly recommends that all customers subscribe to receive alerts when
a Citrix security bulletin is created or modified at https://support.citrix.com
/user/alerts .
Reporting Security Vulnerabilities to Citrix
Citrix welcomes input regarding the security of its products and considers any
and all potential vulnerabilities seriously. For details on our vulnerability
response process and guidance on how to report security-related issues to
Citrix, please see the following webpage: https://www.citrix.com/about/
trust-center/vulnerability-process.html .
Disclaimer
This document is provided on an “as is” basis and does not imply any kind of
guarantee or warranty, including the warranties of merchantability or fitness
for a particular use. Your use of the information on the document is at your
own risk. Citrix reserves the right to change or update this document at any
time. Customers are therefore recommended to always view the latest version of
this document directly from the Citrix Knowledge Center.
Changelog
2023-07-11 T 14:30:00Z Initial Publication
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZK4vxskNZI30y1K9AQi74w//Y3kBu3L/EJbDI0rsH90PqmPdHYXZnfZp
aIfZsYRiNfQTD29YXT3GRtQU1QsamXZJnzC9wbeEExiCchyULbVdedPHb5V+HW/o
oPOxuKKTTeFZwYGU1KeeyxdWdHo34RNb+0uDHCwEnthJ6OY6lcx9q4fXc0lyYOT6
wIM8pEKCauHIj3dY+QZbxJe5B+69hh8aW79NJUCn6b0w92Zb/ddYkPJKv4b4qp5X
rLjjeZ5Cng0SGJ4o8/MyccgqqOC4K1PH9VxusLtHVCiC6H8omtK4KP29CFQdW5MO
v4E4QOFoXHRCOkMKPZ2VBWTEOGVkWxp3+K7eJ599JniQadHa8v3ZkAZyw7oFiZik
IYJMx2KlVb9bB0vgm7HTD54g4sLqxuPz4w1HiHevM9QWZ3DTtS5KqQTWS7QgGr5O
iH/PEdGVCSaXzlxuj7LdjvLpqM0QOpwjSyCxrPNINWB8AUStGcfSGFfNyPBWiHVP
Tubkbqn9/Z+Mi1aIyI3oPlkVAVH5HT/8tA5wxDiWOkSX7ixDS8mAhI6vaikyiqsB
64vtm0DExU+Uzqx3JTX+hNZmwyTxHw4J+3zNVBcbtSmmGPEH10UITXDm5PH8WqzK
jg3/lp87YF3X5GxPV1nKIt5M/cg39Cw5xN+F+jiYlrGVjYN0pI7z4OmtG9hJ4hdh
NWw72G/spKo=
=lvmA
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins