bluebay2014 - Fotolia

News

Citrix vulnerabilities affect ADC, Gateway, SD-WAN

Citrix vulnerabilities in several of its networking products expose its customers to hackers looking to infiltrate computing systems.

Mike Gleason
By
Published: 08 Jul 2020

Citrix has urged customers to patch vulnerabilities in its networking software that hackers could exploit to commandeer computing systems.

The Citrix vulnerabilities affect the company's Application Delivery Controller (ADC), Gateway and SD-WAN products. The firm issued a security bulletin on Tuesday, saying the issue could lead to hackers taking control of a computing system. 

In a blog post accompanying the bulletin, Citrix CISO Fermin Serna said the company's latest patches fix the flaws and Citrix is not aware of any exploitation of the software openings.

Serna said there were other barriers to prevent attackers from exploiting the vulnerabilities. Several methods of attack use the management interface of a device; Citrix had already recommended separating such an interface from the network. Other avenues required attackers already have access to a vulnerable device.

The latest vulnerabilities are not related to earlier flaws in the same products, Serna said.  Security researchers discovered the earlier problem, called CVE-2019-19781, in December 2019. Citrix patched the vulnerability in late January.

Attack vectors grow as remote work increases

Companies use Citrix's ADC and Gateway to deliver the vendor's virtual desktop to remote workers. That highly distributed workforce has grown during the COVID-19 pandemic, which has increased the security demands on IT staff.

"Citrix definitely has a black eye, in general, from these exploits, but the mitigation steps being advised [are] the right ones," independent analyst Eric Klein said.

Andrew Hewitt, an analyst at Forrester Research, said attackers see a worker's home as a weak point in enterprise security. As Citrix is used heavily in work-from-home scenarios, it is a natural target, he said.

Dig Deeper on Virtual desktop delivery tools