Citrix patch for serious flaw won't arrive for weeks

Company admits exploits in Citrix Gateway and Citrix Application Delivery Controller may be being exploited

Citrix plans to push out patches by the end of the month for a serious flaw that it admits hackers may already be targeting.

Last month, Citrix acknowledged that Citrix Gateway and Citrix Application Delivery Controller were at risk because of a critical vulnerability, after the flaw was spotted by Positive Technologies.

Related Resource

Patch management best practices

Reduce your patch management workload

Download now

Citrix admitted that the bug could allow attackers to run code on companies' local networks by taking advantage of apps they published using the systems. At the time, Positive Technologies estimated as many as 80,000 companies in 158 countries could be at risk, including the UK and US.

"Depending on specific configuration, Citrix applications can be used for connecting to workstations and critical business systems (including ERP)," the security firm said at the time. "In almost every case, Citrix applications are accessible on the company network perimeter, and are therefore the first to be attacked. This vulnerability allows any unauthorised attacker to not only access published applications, but also attack other resources of the company's internal network from the Citrix server."

Advertisement - Article continues below
Advertisement - Article continues below

Reports now suggest hackers are already looking to make use of the flaw, with security firm Bad Packets reporting exploit attempts against its honeypots, systems set up to attract attention from criminals. Its scans suggested more than 2,000 servers were vulnerable in the UK as of today. Other researchers have also reported exploit attempts, with a working exploit shared on GitHub.

"There have been reports of network scanning to detect the presence of this vulnerability," Fermin J. Serna, chief information security officer at Citrix, admitted in a blog post this weekend.

However, the company doesn't believe most of its users will be at risk. "As many deployments are behind the firewall, we believe that a limited number of devices are exploitable," Serna said, adding that it recommended following the previously released mitigation advice.

That will have to do until Citrix releases its patches, which will begin to rollout 20 January but could take until the end of the month to complete depending on system version. "As with any product of this nature, and consistent with our policies and procedures, these fixes need to be comprehensive and thoroughly tested," Serna added.

Last year, Citrix's own systems were targeted, leaking 6TB of data.

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now

Most Popular

operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
General Data Protection Regulation (GDPR)

Data protection fines hit £100m during first 18 months of GDPR

20 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020