Citrix NetScaler and Access Gateway Denial Of Service Vulnerability

Bugtraq ID:	36948
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Nov 02 2009 12:00AM
Updated:	Nov 06 2009 04:56PM
Credit:	Rob Carter and Nathan McFeters from Ernst & Young's Advanced Security Center, Neel Mehta from Google Security Team
Vulnerable:	Citrix NetScaler 9.1 Citrix NetScaler 9.0 Citrix Access Gateway Enterprise Edition 9.1 Citrix Access Gateway Enterprise Edition 9.0
Not Vulnerable:	Citrix NetScaler 9.1 build 96.4 Citrix NetScaler 9.0 build 70.5 Citrix Access Gateway Enterprise Edition 9.1 build 96.4 Citrix Access Gateway Enterprise Edition 9.0 build 70.5

Citrix NetScaler and Access Gateway Denial Of Service Vulnerability

Citrix NetScaler and Access Gateway are prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause denial-of-service conditions.

The issue affects the appliance firmware 9.0 (prior to build 70.5) and 9.1 (prior to build 96.4).

The following products are affected:

Citrix NetScaler
NetScaler Application Firewall
Access Gateway Enterprise Edition

Citrix NetScaler and Access Gateway Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Citrix NetScaler and Access Gateway Denial Of Service Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

Citrix NetScaler and Access Gateway Denial Of Service Vulnerability

References:

• Citrix Homepage (Citrix)
  
• CTX123060: Vulnerability in Citrix NetScaler, Citrix NetScaler Application Firew (Citrix)