This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] NetScaler ADC and Gateway fix 2 vulnerabilities
NetScaler fixes 2 vulnerabilities in NetScaler ADC and NetScaler Gateway. Ways to verify affected instances can be found at [1]. Individual products and their fixed versions [1]: NetScaler Gateway - 14.1-29.72, 13.1-55.34 NetScaler ADC - 14.1-29.72, 13.1-55.34 NetScaler ADC FIPS - 13.1-37.207, 12.1-55.321 NetScaler ADC NDcPP - 12.1-55.321
Allows an unauthenticated remote attacker to corrupt data in memory, which may also cause service unavailability. To exploit the vulnerability, the system must be configured as a Gateway (VPN Vserver) with RDP functionality enabled, or as a Gateway (VPN Vserver) with an RDP Proxy Server Profile created and in use, or as an Auth Server (AAA Vserver) with RDP functionality enabled [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
More information:
- CVE-2024-8534 at cve.org, NVD
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Allows an authenticated remote attacker to gain unauthorized access to certain files and folders. To exploit the vulnerability, the system must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configured for Kerberos SSO to access backend resources, or as an Auth Server (AAA Vserver) with KCDAccount configured for Kerberos SSO to access backend resources [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
More information:
- CVE-2024-8535 at cve.org, NVD
- CWE-552: Files or Directories Accessible to External Parties at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
By CESNET, z.s.p.o. Martin Krajči on 28. 11. 2024.