https://worldofeuc.com logo
Join Slack
Powered by
Thread: NetScaler ADC and NetScaler Gateway Securi...
# citrix-netscaler
m
Thread: NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2024-5491 and CVE-2024-5492 https://support.citrix.com/article/CTX677944/
🤔 1
n
No healthy upstream, as per usual. Anyone managed to actually open it and can paste / share it in here?
m
of course, if you like a screenshot:
Is that enough?
🙏 2
👍 1
n
100%, thank you! 😃
m
image.png
image.png
n
Very much appreciated, my gratitude. ^_^
m
IMHO if only NSIP are affected, I would say it isn't urgent.
n
Yeah.. reminds me of the "if your NSIP is on the internet, patch it.. and then remove it" type of CVE's, for now.
l
thank you for the article, I knew the chances of reading it here were far greater than at Citrix 👀
😄 5
❤️ 1
j
Thanks, @Marco Hofmann you got also the critical one where SVM of SDX is affected? It’s https://support.citrix.com/article/CTX677998
m
The link doesn't work for me 😛 We don't have any SDX, so we are not affected?
j
If anyone needs a download, hit me up (I've got my cache ready)
n
Seems to be another one, too.. this is getting out of hand, they're multiplying! 53.24 is fresh off of* the buildserver, 53.23 was released last week.. Build 13.1-53.24 and later builds address the security vulnerabilities described in https://support.citrix.com/article/CTX678072. This build replaces 13.1-53.23.
g
does anyone have a working download link? 😬
j
yes 🙂
j
Netscaler goes from 8.6p1 to 9.3p2 for openssh
g
Now download worked. But thank you @Jan Tytgat 😁
✅ 1
j
ADM goes from 9.3 to 9.2p2
🫣 1
Patched my lab, no issues beyond the usual GUI not working for the NetScaler, upgrade that via CLI
j
Jeff you got a screenshot / copy of the NSC / SVM CVE?
j
No, just did an ssh -V before and after upgrades.
j
i have a PDF of CTX678944 as soon as I have the other one, I'll post it here as well
e
That OpenSSH version is still vulnerable right? Needs to be 9.8p1 right?
j
I think that is for linux, BSD might be different, still researching.
✅ 1
n
Not sure if this is the better result, usually we can read all about the CVE's but never download, download works perfectly this time instead.. 50% there, Citrix!
🎯 2
j
i prefer the downloads to be there
take action first
read up later 😄
j
9.3p2 fixes an earlier RCE, but not the latest.
😢 1
🫣 1
n
Not with a summer change freeze.. : d
j
As long as your management ports and cli is locked down you should be ok. Not as bad as the Gateway and AAA issues from before.
n
Well, to be fair, we've only seen two out of the four CVE's (three pages total) so far in this thread, so I'm still curious as to what the rest will be.
a
Any new bugs ? 🪳
I'm tired of such a weak infrastructure for security-related information that could be critical to clients. 🌻
👍 2
n
Indeed.. if Citrix can send a link in their email notifications, they can send at least a small snippet with a disclaimer that the text can change on the website.
💯 1
l
or place an F5 in front so they can scale 👀
😄 1
👎 1
😂 1
m
If there is just one Raspberry Pi 4 hosting the website you dont need an LB...
🤣 2
💯 1
n
Almost able to open the pages now, at least. CTX677998(SVM) is restricted, the rest works.
r
It never ceases to amaze me the complaints. F5 has had 25 CVEs since February 14th of this year. These will bring NetScaler's total for all of 2024 to 6. And before you say severity, 12 of F5's 25 were >7 on the CVSS ranking. I mean, Windows literally has to be patched monthly to fix security issues. Chrome is getting close to that. To get to 25 CVEs on NetScaler, you must go back to 2018. If I have to start patching my NetScalers monthly for a CVE, then I'll get upset.
j
Nobody is complaining Richard, the only complaint is that we can;t read the CTX-articles
For the rest, patching customers💶💶eruo
😄
l
Exactly, no complaints about the CVE, more about not being able to read or download
💯 1
r
"Seems to be another one, too.. this is getting out of hand, they're multiplying!"
n
Haha.. yeah, the fact that we went from one link, to two links, to three links. Call that a complaint or a joke? ^_^
I said it as a joke, but, it's up to you to interpret it as you'd like.
r
Funny part about the availability of the articles which I did give them grief about when I worked there is the site and downloads are Akamai. SMH.
j
it's Google Frontend now
not that it's better 😛
the downloads at least work for once 😄
r
Definitely not better
o
It appears we have adopted a "follow the sun model" for DDOS'ing the CTX NS download CDN. 1 - The European CTX community members start their day by crashing the site 2 - We (the north Americans) then take over crashing the site. 3 - We all complain together in real-time, it's glorious, I ain't even mad anymore 😜
p
But hey..no worries…only sec bulletins on ALL the products ..royal flush of CVE´s
j
I was wondering if today was a full moon day or what was going on.
r
Is Cloud Software Group wanting to have their own "Patch Tuesday?"
Certainly won the trifecta today
🙌 1
a
Love that I come online to all this overnight advising of patching required to go to 14.1 25.54, but by the time I get to download it it's already changed to 14.1 25.56 as the available download. Things changing so quickly at CSG there will probably be a new build by the time my patch window arrives.
j
Has anyone seen issues with MPX 5900 updating to this new 13.1 firmware? Have a site being weird and wondering if it is the firmware, or just a fluke.
5 Views
Open in Slack
PreviousNext
Powered by