Citrix patch for serious flaw won't arrive for weeks

Company admits exploits in Citrix Gateway and Citrix Application Delivery Controller may be being exploited

Citrix plans to push out patches by the end of the month for a serious flaw that it admits hackers may already be targeting.

Last month, Citrix acknowledged that Citrix Gateway and Citrix Application Delivery Controller were at risk because of a critical vulnerability, after the flaw was spotted by Positive Technologies.

Related Resource

Patch management best practices

Reduce your patch management workload

Download now

Citrix admitted that the bug could allow attackers to run code on companies' local networks by taking advantage of apps they published using the systems. At the time, Positive Technologies estimated as many as 80,000 companies in 158 countries could be at risk, including the UK and US.

"Depending on specific configuration, Citrix applications can be used for connecting to workstations and critical business systems (including ERP)," the security firm said at the time. "In almost every case, Citrix applications are accessible on the company network perimeter, and are therefore the first to be attacked. This vulnerability allows any unauthorised attacker to not only access published applications, but also attack other resources of the company's internal network from the Citrix server."

Reports now suggest hackers are already looking to make use of the flaw, with security firm Bad Packets reporting exploit attempts against its honeypots, systems set up to attract attention from criminals. Its scans suggested more than 2,000 servers were vulnerable in the UK as of today. Other researchers have also reported exploit attempts, with a working exploit shared on GitHub.

"There have been reports of network scanning to detect the presence of this vulnerability," Fermin J. Serna, chief information security officer at Citrix, admitted in a blog post this weekend.

However, the company doesn't believe most of its users will be at risk. "As many deployments are behind the firewall, we believe that a limited number of devices are exploitable," Serna said, adding that it recommended following the previously released mitigation advice.

That will have to do until Citrix releases its patches, which will begin to rollout 20 January but could take until the end of the month to complete depending on system version. "As with any product of this nature, and consistent with our policies and procedures, these fixes need to be comprehensive and thoroughly tested," Serna added.

Last year, Citrix's own systems were targeted, leaking 6TB of data.

Featured Resources

Unleashing the power of AI initiatives with the right infrastructure

What key infrastructure requirements are needed to implement AI effectively?

Download now

Achieve today. Plan tomorrow. Making the hybrid multi-cloud journey

A Veritas webinar on implementing a hybrid multi-cloud strategy

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

The workers' experience report

How technology can spark motivation, enhance productivity and strengthen security

Download now

Most Popular

How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
WhatsApp could face €50 million GDPR fine
General Data Protection Regulation (GDPR)

WhatsApp could face €50 million GDPR fine

25 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021