======================================================================

                              CERT-Renater

                    Note d'Information No. 2024/VULN273
_____________________________________________________________________

DATE                : 31/05/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Citrix Workspace App for Mac
                              versions prior to 2402.10.

=====================================================================
https://support.citrix.com/article/CTX675851/citrix-workspace-app-for-mac-security-bulletin-for-cve20245027
_____________________________________________________________________

Citrix Workspace app for Mac Security Bulletin for CVE-2024-5027


Applicable Products

     Citrix Workspace App for Mac

Description of Problem

A vulnerability has been discovered in Citrix Workspace app for Mac,
which, if exploited, may result in elevation of privilege from a local
authenticated user to a root user.
Affected Versions:
The following supported versions of Citrix Workspace app for Mac are
affected by the vulnerability:
     Citrix Workspace app for Mac before 2402.10

Summary:

CVE ID 	Description 	Pre-requisites 	CWE 	CVSS

CVE-2024-5027 	Elevation of privilege from a local authenticated user
to a root user 	Attacker must have local authenticated user access to
the device where CWA for Mac is installed 	CWE-233 	7,7


What Customers Should Do

Cloud Software Group strongly urges affected customers of Citrix
Workspace app for Mac to install the relevant updated versions of
Citrix Workspace app for Mac as soon as possible:
     Citrix Workspace app for Mac 2402.10  and later


What Citrix is Doing
Citrix is notifying customers and channel partners about this
potential security issue through the publication of this security
bulletin on the Citrix Knowledge Center at
https://support.citrix.com/securitybulletins.


Obtaining Support on This Issue
If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical
Support are available at
https://www.citrix.com/support/open-a-support-case.


Subscribe to Receive Alerts
Citrix strongly recommends that all customers subscribe to receive
alerts when a Citrix security bulletin is created or modified
at https://support.citrix.com/user/alerts.


Reporting Security Vulnerabilities to Citrix
Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. For
details on our vulnerability response process and guidance on how
to report security-related issues to Citrix, please see the
following webpage:
https://www.citrix.com/about/trust-center/vulnerability-process.html.


Disclaimer
This document is provided on an "as is" basis and does not imply
any kind of guarantee or warranty, including the warranties of
merchantability or fitness for a particular use. Your use of the
information on the document is at your own risk. Citrix reserves
the right to change or update this document at any time. Customers
are therefore recommended to always view the latest version of
this document directly from the Citrix Knowledge Center.


Changelog
2024-05-28 T 16:00:00Z 	Initial publication

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================