=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN439
_____________________________________________________________________

DATE                : 08/10/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Systems running Citrix NetScaler ADC version 10.0
                             prior to version 10.0-76.7.

======================================================================
http://support.citrix.com/article/ctx139017
______________________________________________________________________

 Citrix NetScaler Application Delivery Controller Denial of Service
Vulnerability

Document ID: CTX139017
Created On: Oct 1, 2013
Updated On: Oct 1, 2013

Severity: Low


Description of Problem

A denial of service vulnerability has been identified in Citrix
NetScaler Application Delivery Controller (ADC). This vulnerability,
when exploited, could cause the Citrix NetScaler appliance to become
temporarily unavailable for normal use.

This vulnerability affects Citrix NetScaler ADC version 10.0 prior to
version 10.0-76.7 only.

Citrix NetScaler ADC versions 10.1 and 9.3 are not affected by this

vulnerability.


Mitigating Factors

When deployed in the recommended configuration, the affected interface
would not be exposed to remote attackers.

The NetScaler ADC appliance will recover following a successful exploit.


What Customers Should Do

This vulnerability has been addressed in Citrix NetScaler ADC version
10.0-76.7 and later. Citrix recommends that affected customers upgrade
to a version of the appliance firmware that contains this fix as part of
their normal patching schedule. These new firmware versions can be
obtained from the following locations:

https://www.citrix.com/downloads/netscaler-adc/firmware.html
https://www.citrix.com/downloads/netscaler-adc/virtual-appliances.html


Acknowledgements

Citrix thanks Stefan Viehböck of SEC Consult Vulnerability Lab
(http://www.sec-consult.com/) for working with us to protect Citrix
customers.


What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential
security issue. This article is also available from the Citrix Knowledge
Center at http://support.citrix.com/.


Obtaining Support on This Issue

If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical Support
are available at http://www.citrix.com/site/ss/supportContacts.asp.


Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. If you would
like to report a security issue to Citrix, please compose an e-mail to
secure@citrix.com stating the exact version of the product in which the
vulnerability was found and the steps needed to reproduce the vulnerability.


This document applies to:

NetScaler 10
NetScaler VPX 10.0

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================