On the 17th of December Citrix released an advisory for a critical vulnerability in Citrix ADC and Citrix Gateway, formerly known as NetScaler. An attacker without credentials can execute code on the device. There is no patch yet, only a configuration change that mitigates it.<\/p>\n
Think about where these devices sit. At the edge of your network, open to internet, handling the remote access for your users. If an attacker owns that box he is not at your door, he is already in the hall.<\/p>\n
So before you leave for Christmas: Apply the mitigation from Citrix now, not after the holidays. Make sure you have a list of every appliance at the edge, not only Citrix, and who is responsible for patching it. These boxes are often forgotten because they are \u2018network\u2019 and not \u2018servers\u2019. And go through the logs from the device. If someone found the hole before the advisory you want to know.<\/p>\n
Attackers love holidays. Fewer people watching, slower reactions and a lot of systems that nobody dares to touch until January.<\/p>\n
Merry Christmas, and patch your gateway.<\/p>\n","protected":false},"excerpt":{"rendered":"
On the 17th of December Citrix released an advisory for a critical vulnerability in Citrix ADC and Citrix Gateway, formerly known as NetScaler. An attacker without credentials can execute code on the device. There is no patch yet, only a configuration change that mitigates it. Think about where these devices sit. At the edge of […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[52,37,43],"class_list":["post-1053","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-citrix","tag-patching","tag-remote-access"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1053"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1053\/revisions"}],"predecessor-version":[{"id":1065,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1053\/revisions\/1065"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}