Citrix Workspace App and Receiver for Windows CVE-2019-11634 Remote Code Execution Vulnerability

Bugtraq ID:	108334
Class:	Access Validation Error
CVE:	CVE-2019-11634
Remote:	Yes
Local:	No
Published:	May 13 2019 12:00AM
Updated:	May 13 2019 12:00AM
Credit:	Ollie Whitehouse, Richard Warren and Martin Hill of NCC Group.
Vulnerable:	Citrix Workspace App for Windows 1903 Citrix Workspace App for Windows 1902 Citrix Receiver for Windows 4.9.6
Not Vulnerable:	Citrix Workspace App for Windows 1904.1 Citrix Workspace App for Windows 1904 Citrix Receiver for Windows 4.9.6001

Citrix Workspace App and Receiver for Windows CVE-2019-11634 Remote Code Execution Vulnerability

Citrix Workspace App and Receiver for Windows are prone to a remote code-execution vulnerability.

Successfully exploiting this issue will allow attackers to execute arbitrary code on the device.

The following products are vulnerable:

Citrix Workspace App for Windows versions prior to 1904 are vulnerable.
Citrix Receiver for Windows version LTSR 4.9 CU6 is vulnerable.

Citrix Workspace App and Receiver for Windows CVE-2019-11634 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Citrix Workspace App and Receiver for Windows CVE-2019-11634 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Citrix Workspace App and Receiver for Windows CVE-2019-11634 Remote Code Execution Vulnerability

References:

• Citrix Homepage (Citrix)
  
• Remote Code Execution Vulnerability in Citrix Workspace app and Receiver for Win (Citrix)