====================================================================

                             CERT-Renater

                 Note d'Information No. 2019/VULN268

_____________________________________________________________________

DATE                : 06/09/2019

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows running Citrix License Server versions
                            prior to 11.15.0.0 Build 27000,
                      Systems running Citrix License Server VPX.

=====================================================================
https://support.citrix.com/article/CTX257644
_____________________________________________________________________

CVE-2019-13609 - CRLF Vulnerability in Citrix License Server for Windows
and VPX

Reference: CTX257644

Category : Medium

Created  : 27 Aug 2019

Modified : 28 Aug 2019

Applicable Products

  o Licensing

Description of Problem

A Carriage Return Line Feed (CRLF) injection vulnerability has
been identified in Citrix License Server for Windows and VPX that
could allow an unauthenticated attacker to bypass authentication
and allow a malicious website to read or modify license server data
of an existing logged on session.

This vulnerability has been assigned the following CVE number:

o CVE-2019-13609: CRLF Vulnerability in License Server for Windows
  and VPX

This vulnerability affects the following Citrix License Server versions:

o Citrix License Server for Windows earlier than 11.15.0.0 Build 27000.

o Citrix License Server VPX all supported versions.


Mitigating Factors

If access to admin console is restricted to trusted network the risk
is reduced.

Security considerations for the admin console interface can be found
at the following URL:

https://docs.citrix.com/en-us/licensing/current-release/getting-started.html


Under security considerations

"Configure the License Server environment so that only authorized
administrators on a trusted network can access the Licensing
Administration Console port. You achieve this outcome by using
an appropriately configured network or host-based firewall."


What Customers Should Do

The CRLF vulnerability has been addressed in the following version:

o Citrix License Server for Windows version 11.15.0.0 Build 27000 and newer.

Customers with Citrix License Server VPX will need to deploy the Windows
version for the fix.

Citrix recommends that customers upgrade their Citrix License Server
deployments to this version or later.

The updates can be obtained from the following location:

https://www.citrix.com/downloads/licensing/


Acknowledgements

Citrix thanks Vahagn Vardanyan for working with us to protect Citrix
customers.


Changelog

+----------------+------------------------------------------------------------+
|Date            |Change                                               |
+----------------+------------------------------------------------------------+
|27th August 2019|Initial Publication                                  |
+----------------+------------------------------------------------------------+
|28th August 2019|Updated "Applicable Products" section to include
                                          Licensing                    |
+----------------+------------------------------------------------------------+


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================