====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN502
_____________________________________________________________________

DATE                : 09/09/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Citrix StoreFront versions prior to
         1912 CU1 (1912.0.1000), 3.0 for 7.6 LTSR CU8 Hotfix (3.0.8001),
                      3.12 for 7.15 LTSR CU5 Hotfix (3.12.5001).

=====================================================================
https://support.citrix.com/article/CTX277455
_____________________________________________________________________

Citrix StoreFront Security Update

Reference: CTX277455

Category : High

Created  : 08 Sep 2020

Modified : 08 Sep 2020

Applicable Products

  o StoreFront


Description of Problem

An issue has been discovered in Citrix StoreFront that, if exploited,
would allow an attacker who is authenticated on the same Microsoft
Active Directory domain as a Citrix StoreFront server to read arbitrary
files from that server.

This issue has the following identifier:

  o CVE-2020-8200

The issue affects the following supported Current Release (CR) versions
of Citrix StoreFront:

  o Citrix StoreFront before 1909

The issue affects the following supported Long Term Service Release
(LTSR) versions of Citrix StoreFront:

  o Citrix StoreFront 1912 LTSR before CU1 (1912.0.1000)
  o Citrix StoreFront 3.12 for 7.15 LTSR before CU5 Hotfix (3.12.5001)
  o Citrix StoreFront 3.0 for 7.6 LTSR before CU8 Hotfix (3.0.8001)

Note that Citrix StoreFront is included as part of Citrix Virtual Apps
and Desktops. Therefore, some customers may be affected who have not
independently installed Citrix StoreFront.

Customers running Citrix Virtual Apps and Desktops 2003 should note that
the version of Citrix StoreFront included in that release, 1912 LTSR, is
one of the affected versions.


Mitigating Factors

If users are not in the same Microsoft Active Directory domain as the
Citrix StoreFront server, the vulnerability is not exploitable, even if
the users are authenticated in a transitively trusted domain. Note that
this applies even if the user is logged into the Citrix StoreFront
server.


What Customers Should Do

The issue has been addressed in the following Citrix StoreFront versions:

  o Citrix StoreFront 1912 CU1 (1912.0.1000) and later versions of Citrix
    StoreFront 1912 LTSR
  o Citrix StoreFront 3.0 for 7.6 LTSR CU8 Hotfix (3.0.8001) and later
    versions of StoreFront 3.0 for 7.6 LTSR
  o Citrix StoreFront 3.12 for 7.15 LTSR CU5 Hotfix (3.12.5001) and
    later versions of StoreFront 3.12 for 7.15 LTSR

Citrix strongly recommends that customers running affected versions of
Citrix StoreFront, both CR and LTSR versions, upgrade to a fixed version
as soon as possible.

The latest versions of Citrix StoreFront can be downloaded from the
following location:

https://www.citrix.com/downloads/storefront/

https://support.citrix.com/article/CTX277537

https://support.citrix.com/article/CTX277538


Acknowledgements

Citrix would like to thank Harrison Neal of Patch Advisor for working
with us to protect Citrix customers.


Changelog

+--------------------------+-------------------------------------------+
|Date                      |Change                                     |
+--------------------------+-------------------------------------------+
|2020-09-08                |Initial Publication                        |
+--------------------------+-------------------------------------------+

=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================