Citrix has released patches to address two vulnerabilities, one of which is considered critical, in its NetScaler ADC and NetScaler Gateway products. The first vulnerability, CVE-2023-4966, is classified as an information disclosure issue with a critical CVSS score of 9.4. The second vulnerability, CVE-2023-4967, is a denial-of-service bug with a CVSS score of 8.2. Both vulnerabilities are related to buffer issues.
The affected appliances are only vulnerable if configured as gateways (VPN virtual server, ICA proxy, clientless access CVPN, or RDP proxy) or AAA (authentication, authorization, accounting) virtual servers. Fixed releases are available for affected software versions, except for DC and NetScaler Gateway version 12.1, which is end-of-life.
In addition to addressing these issues, Citrix has also released patches to resolve several third-party vulnerabilities in its Hypervisor running on AMD processors. These vulnerabilities may expose a system to compromise through privileged code running in a guest virtual machine.
These actions underscore the ongoing need for vigilance and timely patching to address potential security threats.