Contact Support

Customers who viewed this article also viewed

banner icon

Identify Changes in NetScaler build files with

File Integrity Monitoring

Learn More Watch Video
CTX457048 {{tooltipText}}

Citrix ADC and Citrix Gateway Security Bulletin for CVE-2022-27507 and CVE-2022-27508

Applicable Products

  • Citrix ADC
  • Citrix Gateway

Description of Problem

Vulnerabilities have been discovered in Citrix ADC and Citrix Gateway that, if exploited, could result in a denial of service. 

These vulnerabilities have the following identifiers: 

CVE-ID  

Description  

CWE  

Pre-conditions 

CVE-2022-27507 

Authenticated denial of service 

CWE-400: Uncontrolled Resource Consumption  

 

VPN (Gateway) virtual server with  

  • DTLS, and  

  • either 'HDX Insight for EDT traffic' or 'SmartControl' is configured 

CVE-2022-27508 

Unauthenticated denial of service 

CWE-400: Uncontrolled Resource Consumption  

 

Appliance must be configured as a VPN (Gateway) or AAA virtual server 

 

CVE-2022-27507 (Medium severity)

The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability if DTLS is enabled and either ‘HDX Insight for EDT traffic’ or ‘SmartControl’ have been configured: 

  • Citrix ADC and Citrix Gateway 13.1 before 13.1-21.50  

  • Citrix ADC and Citrix Gateway 13.0 before 13.0-85.19

  • Citrix ADC and Citrix Gateway 12.1 before 12.1-64.17  

  • Citrix ADC 12.1-FIPS before 12.1-55.278 

  • Citrix ADC 12.1-NDcPP before 12.1-55.278 

Citrix ADC and Citrix Gateway are vulnerable if both of the following conditions are met: 

  1. DTLS is enabled:  

Customers can determine if DTLS is enabled by executing the following CLI command: 

show vpn vserver 

For each vServer, "Dtls : ON" or "Dtls : OFF" will indicate the DTLS state. 
 

  1. ‘HDX Insight for EDT traffic’ or ‘SmartControl’ is configured:  

Customers can determine if ‘HDX Insight for EDT traffic’ or ‘SmartControl’, has been configured by inspecting the ns.conf file for a VPN vserver policy binding with an ICA_REQUEST type. For example: 

bind vpn vserver <name> -policy <policy_name> -priority 100 -type ICA_REQUEST 

 

CVE-2022-27508 (High severity)

The only supported version of Citrix ADC and Citrix Gateway affected by this vulnerability is: 

  • Citrix ADC and Citrix Gateway 12.1-64.16  

All other supported versions of Citrix ADC and Citrix Gateway, including FIPS and NDcPP versions are not affected by this issue. 


What Customers Should Do

Citrix recommends that affected customers install the relevant updated versions of Citrix ADC or Citrix Gateway as soon as possible.  

  • Citrix ADC and Citrix Gateway 13.1-21.50 and later releases 

  • Citrix ADC and Citrix Gateway 13.0-85.19 and later releases of 13.0  

  • Citrix ADC and Citrix Gateway 12.1-64.17 and later releases of 12.1  

  • Citrix ADC 12.1-FIPS 12.1-55.278 and later releases of 12.1-FIPS  

  • Citrix ADC 12.1-NDcPP 12.1-55.278 and later releases of 12.1-NDcPP 
     

Customers who are only impacted by CVE-2022-27507 and have DTLS enabled and have configured ‘HDX Insight for EDT traffic’ or 'SmartControl' can alternatively disable ‘HDX Insight for EDT traffic’ to address the issue without upgrading by using the following shell commands: 

nsapimgr -ys enable_ica_edtinsight=0  

echo "nsapimgr -ys enable_ica_edtinsight=0" >> /nsconfig/rc.netscaler  

This will ensure it is persistently applied after a reboot of the Citrix ADC appliance.

Note that this will prevent some HDX Insight analytics information from being logged. 

Also, note also that the commands should be removed after upgrading to a version that addresses the vulnerability. 


What Citrix is Doing

Citrix is notifying customers and channel partners about this potential security issue through the publication of this security bulletin on the Citrix Knowledge Center at https://support.citrix.com/securitybulletins.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at https://www.citrix.com/support/open-a-support-case.

Subscribe to Receive Alerts

Citrix strongly recommends that all customers subscribe to receive alerts when a Citrix security bulletin is created or modified at https://support.citrix.com/user/alerts.

Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For details on our vulnerability response process and guidance on how to report security-related issues to Citrix, please see the following webpage: https://www.citrix.com/about/trust-center/vulnerability-process.html.

Disclaimer

This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. Citrix reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document directly from the Citrix Knowledge Center.

Changelog

Date Change
2022-05-25 Initial Publication