====================================================================

                             CERT-Renater

                 Note d'Information No. 2018/VULN086
_____________________________________________________________________

DATE                : 01/03/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Citrix NetScaler Application
                        Delivery Controller (ADC),
                     Citrix NetScaler Gateway.

=====================================================================
https://support.citrix.com/article/CTX232199
_____________________________________________________________________

CTX232199

Authentication Bypass Vulnerability in Citrix NetScaler Application
Delivery Controller (ADC) and NetScaler Gateway

Security Bulletin | Medium | Created: 28 Feb 2018 | Modified: 28 Feb 2018

Applicable Products

  o NetScaler 12.0
  o NetScaler 11.1
  o NetScaler 11.0
  o NetScaler Gateway 12.0
  o NetScaler Gateway 11.1
  o NetScaler Gateway 11.0

Description of Problem

A vulnerability has been identified in the management interface of
Citrix NetScaler Application Delivery Controller (ADC) and NetScaler
Gateway that, if exploited, could allow an unauthenticated attacker with
access to the NetScaler management interface to bypass authentication
controls and execute arbitrary, read only commands on the NetScaler
appliance.

This vulnerability has been assigned the following CVE number:

  o CVE-2018-5314: Authentication Bypass Vulnerability in Citrix
NetScaler ADC
    and NetScaler Gateway Management Interface

This vulnerability affects the following product versions:

  o Citrix NetScaler ADC and NetScaler Gateway version 12.0 builds
    41.16, 41.22, 41.24, 51.24 & 53.6
  o Citrix NetScaler ADC and NetScaler Gateway version 11.1 builds
    51.21, 51.26, 52.13, 53.11, 54.14, 54.16 & 55.10
  o Citrix NetScaler ADC and NetScaler Gateway version 11.0 build 70.12

This vulnerability also affects the NetScaler Load Balancing instance
distributed with Citrix NetScaler SD-WAN/CloudBridge 4000, 4100, 5000
and 5100 WAN Optimization Edition version 9.3.0

-
-------------------------------------------------------------------------------

Mitigating Factors

In order to exploit this vulnerability, an attacker would require
access to the management interface of the NetScaler. In situations
where customers have deployed their NetScaler ADC and NetScaler Gateway
appliances in line with industry best practice, network access to this
interface should already be restricted.

-
-------------------------------------------------------------------------------

What Customers Should Do

This vulnerability has been addressed in the following versions of
Citrix NetScaler ADC and NetScaler Gateway:

  o Citrix NetScaler ADC and NetScaler Gateway version 12.0 build 53.13
    and later
  o Citrix NetScaler ADC and NetScaler Gateway version 11.1 build 55.13
    and later
  o Citrix NetScaler ADC and NetScaler Gateway version 11.0 build 70.16
    and later
  o Citrix NetScaler SD-WAN/CloudBridge 4000, 4100, 5000 and 5100 WAN
    Optimization Edition version 9.3.1 and later

Citrix recommends that customers impacted by this vulnerability upgrade
to a version of the Citrix NetScaler ADC, NetScaler Gateway and
NetScaler SD-WAN/ Cloudbridge that contains a fix for this issue as
soon as possible.

These versions are available on the Citrix website at the following
addresses:

https://www.citrix.com/downloads/netscaler-adc/

https://www.citrix.com/downloads/netscaler-gateway/

https://www.citrix.com/downloads/netscaler-sd-wan/

In line with industry best practice, Citrix also recommends that
customers limit access to the management interface to trusted traffic
only. Citrix has published additional guidance on the secure
configuration of NetScaler management interfaces. This can be found at
the following location:

https://support.citrix.com/article/CTX228148

-
-------------------------------------------------------------------------------

Acknowledgements

Citrix thanks xcuter, blankcon, nullbr4in, loupos, koredge of NAVER
BUSINESS PLATFORM - IT Security (https://www.nbp-corp.com) for working
with us to protect Citrix customers

-
-------------------------------------------------------------------------------

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential
security issue. This article is also available from the Citrix
Knowledge Center at http://support.citrix.com/.

-
-------------------------------------------------------------------------------

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical Support
are available at
https://www.citrix.com/support/open-a-support-case.html.

-
-------------------------------------------------------------------------------

Reporting Security Vulnerabilities

Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. For guidance
on how to report security-related issues to Citrix, please see the
following document: CTX081743
- - Reporting Security Issues to Citrix

-
-------------------------------------------------------------------------------

Changelog

+--------------------------------------+--------------------------------------+
|Date                                  |Change                         |
+--------------------------------------+--------------------------------------+
|28th February 2018                    |Initial publishing             |
+--------------------------------------+--------------------------------------+

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================