Citrix NetScaler Access Gateway Default Configuration Unauthorized Access Vulnerability

Bugtraq ID:	35422
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	May 05 2009 12:00AM
Updated:	Jun 18 2009 02:09PM
Credit:	Security Assurance Team of the National Australia Bank
Vulnerable:	Citrix NetScaler Access Gateway Enterprise Edition 8.1
Not Vulnerable:

Citrix NetScaler Access Gateway Default Configuration Unauthorized Access Vulnerability

Citrix NetScaler Access Gateway is prone to a vulnerability that can allow an attacker to gain unauthorized access to network resources, which may help in other attacks.

This issue affects NetScaler Access Gateway Enterprise Edition with firmware 8.1 and earlier.

NOTE: Appliances running version 9.0 that were upgraded from a previous version are also affected.

Citrix NetScaler Access Gateway Default Configuration Unauthorized Access Vulnerability

Attackers can use standard tools to exploit this issue.

Citrix NetScaler Access Gateway Default Configuration Unauthorized Access Vulnerability

Solution:
The vendor has provided instructions for fixing the issue, which involve changes to the default authorization policy. Please see the references for details.

NOTE: Fresh installations of the firmware version 9.0 are not affected by this issue.

Citrix NetScaler Access Gateway Default Configuration Unauthorized Access Vulnerability

References:

• Citrix NetScaler Homepage (Citrix)
  
• Weakness in the Default Configuration of NetScaler Access Gateway Enterprise Edi (Citrix)