Citrix patch for serious flaw won't arrive for weeks

Company admits exploits in Citrix Gateway and Citrix Application Delivery Controller may be being exploited

Citrix plans to push out patches by the end of the month for a serious flaw that it admits hackers may already be targeting.

Last month, Citrix acknowledged that Citrix Gateway and Citrix Application Delivery Controller were at risk because of a critical vulnerability, after the flaw was spotted by Positive Technologies.

Related Resource

Patch management best practices

Reduce your patch management workload

Download now

Citrix admitted that the bug could allow attackers to run code on companies' local networks by taking advantage of apps they published using the systems. At the time, Positive Technologies estimated as many as 80,000 companies in 158 countries could be at risk, including the UK and US.

"Depending on specific configuration, Citrix applications can be used for connecting to workstations and critical business systems (including ERP)," the security firm said at the time. "In almost every case, Citrix applications are accessible on the company network perimeter, and are therefore the first to be attacked. This vulnerability allows any unauthorised attacker to not only access published applications, but also attack other resources of the company's internal network from the Citrix server."

Reports now suggest hackers are already looking to make use of the flaw, with security firm Bad Packets reporting exploit attempts against its honeypots, systems set up to attract attention from criminals. Its scans suggested more than 2,000 servers were vulnerable in the UK as of today. Other researchers have also reported exploit attempts, with a working exploit shared on GitHub.

"There have been reports of network scanning to detect the presence of this vulnerability," Fermin J. Serna, chief information security officer at Citrix, admitted in a blog post this weekend.

However, the company doesn't believe most of its users will be at risk. "As many deployments are behind the firewall, we believe that a limited number of devices are exploitable," Serna said, adding that it recommended following the previously released mitigation advice.

That will have to do until Citrix releases its patches, which will begin to rollout 20 January but could take until the end of the month to complete depending on system version. "As with any product of this nature, and consistent with our policies and procedures, these fixes need to be comprehensive and thoroughly tested," Serna added.

Last year, Citrix's own systems were targeted, leaking 6TB of data.

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
How to speed up Microsoft's Windows 11
Microsoft Windows

How to speed up Microsoft's Windows 11

9 Nov 2021
Nike to take customers into the metaverse with 'NIKELAND'
virtualisation

Nike to take customers into the metaverse with 'NIKELAND'

19 Nov 2021