TTCSIRT-269.012020: TT-CSIRT ADVISORY- CITRIX ADDS SD-WAN WANOP, UPDATED MITIGATIONS TO CVE-2019-19781 ADVISORY
Citrix has released an article with updates on CVE-2019-19781, a vulnerability affecting Citrix Application Delivery Controller (ADC) and Citrix Gateway.
This vulnerability also affects Citrix SD-WAN WANOP product versions 10.2.6 and version 11.0.3. The article includes updated mitigations for Citrix ADC and Citrix Gateway Release 12.1 build 50.28.
An attacker could exploit CVE-2019-19781 to take control of an affected system. Citrix plans to begin releasing security updates for affected software starting January 20, 2020.
The Trinidad and Tobago Cyber Security Incident Response Team (TTCSIRT) recommends users and administrators:
- Review the Citrix article on updates on Citrix ADC, Citrix Gateway vulnerability, published January 17, 2020;
- See Citrix Security Bulletin CTX267027 – Vulnerability in Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP appliance;
- Apply the recommended mitigations in CTX267679 – Mitigation Steps for CVE-2019-19781; and
- Verify the successful application of the above mitigations by using the tool in CTX269180 – CVE-2019-19781 – Verification ToolTest.
For further review please see the following links:
https://www.citrix.com/blogs/2020/01/17/citrix-updates-on-citrix-adc-citrix-gateway-vulnerability/
https://support.citrix.com/article/CTX267027