Citrix NetScaler Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	67160
Class:	Design Error
CVE:	CVE-2014-2882
Remote:	Yes
Local:	No
Published:	Apr 30 2014 12:00AM
Updated:	May 07 2014 12:13PM
Credit:	Graham Sutherland
Vulnerable:	Citrix Access Gateway Enterprise Edition 9.2
Not Vulnerable:

Citrix NetScaler Certificate Validation Security Bypass Vulnerability

Citrix NetScaler Application Delivery Controller and NetScaler Gateway management are prone to a security-bypass vulnerability because it fails to properly validate SSL certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Citrix NetScaler Application Delivery Controller prior 9.3-66.5to and NetScaler Gateway management prior to 10.1-122.17 are vulnerable.

Citrix NetScaler Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Citrix NetScaler Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Citrix NetScaler Certificate Validation Security Bypass Vulnerability

References:

• Citrix Homepage (Citrix)