• Citrix announces security patches for some (but not all) of its compromised products

    Posted on January 20, 2020 at 17:01 CST by • Comment in the Forums

    Citrix says it’s fixed some things, and will fix the rest soon. Per the web announcement:

    Permanent fixes for ADC versions 11.1 and 12.0 are available as downloads here and here.

    • These fixes also apply to Citrix ADC and Citrix Gateway Virtual Appliances (VPX) hosted on any of ESX, Hyper-V, KVM, XenServer, Azure, AWS, GCP or on a Citrix ADC Service Delivery Appliance (SDX). SVM on SDX does not need to be updated.
    • It is necessary to upgrade all Citrix ADC and Citrix Gateway 11.1 instances (MPX or VPX) to build 11.1.63.15 to install the security vulnerability fixes. It is necessary to upgrade all Citrix ADC and Citrix Gateway 12.0 instances (MPX or VPX) to build 12.0.63.13 to install the security vulnerability fixes.

    Nope, that doesn’t cover all the bases.

    We have moved forward the availability of permanent fixes for other ADC versions and for SD-WAN WANOP from our previous target dates as follows:

    • ADC version 12.1, now January 24
    • ADC version 13 and ADC version 10.5, now January 24
    • SD-WAN WANOP fixes, now January 24

    “Soon” being relative, I guess.

    UPDATE: As of early Tuesday morning, Kevin Beaumont reports that GreyNoise’s honeypots are trapping lots of attempts to break into Citrix Gateway systems.

    The top thirty most scanned URLs today are almost all Citrix Gateway related. If you haven’t patched or mitigated your devices, you’re likely in deep doo doo. There’s another nugget in that data, which is people are scanning for Citrix devices using other paths, e.g. font files etc – likely IDS avoidance technique.

    Details in Computerworld Woody on Windows.

    UPDATE: FireEye just released a tool that scans for infections. Citrix has details.

    Uncategorized
DON'T MISS OUT!
Subscribe to the Free Newsletter
We promise not to spam you. Unsubscribe at any time.
Invalid email address

View the Forum

  • Recent Replies
  • My Replies
  • My Active Topics
  • New Posts in the Last day
  • Private Messages
  • Knowledge Base
  • How to use the Forums
  • All Forums

    • Recent Topics

    My Profile

    April 2025
    S M T W T F S
     12345
    6789101112
    13141516171819
    20212223242526
    27282930  

    Remembering Woody

     

    Want to Advertise in the free newsletter? How about a gift subscription in honor of a birthday? Send an email to sb@askwoody.com to ask how.

    Mastodon profile for DefConPatch
    Mastodon profile for AskWoody

     

    Home • About • FAQ • Posts & Privacy • Forums • My Account
    Register • Free Newsletter • Plus Membership • Gift Certificates • MS-DEFCON Alerts

    Copyright ©2004-2025 by AskWoody Tech LLC. All Rights Reserved.