PT-2019-18111 · Citrix · Citrix Netscaler Gateway+1

Publicado 2019-02-22 · Atualizado 2020-08-24 · CVE-2019-6485

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Citrix NetScaler Gateway versions 10.5 through 12.1 before build 50.31 Citrix Application Delivery Controller (ADC) versions 10.5 through 12.1 before build 50.31

Description The issue allows remote attackers to obtain sensitive plaintext information due to a TLS Padding Oracle Vulnerability when CBC-based cipher suites are enabled.

Recommendations For Citrix NetScaler Gateway versions 10.5 through 12.1 before build 50.31, update to build 50.31 or later. For Citrix Application Delivery Controller (ADC) versions 10.5 through 12.1 before build 50.31, update to build 50.31 or later.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2019-6485

Produtos afetados

Citrix Application Delivery Controller

Citrix Netscaler Gateway

Referências · 5

• https://github.com/RUB-NDS/TLS-Padding-Oracles · Nota
• http://securityfocus.com/bid/106783 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-6485 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-6485 · Aviso do Fabricante
• https://support.citrix.com/article/CTX240139 · Aviso do Fabricante