Exploited
critical
9.4
CWE
119
Advisory Published
Updated

CVE-2023-4966: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

First published: Tue Oct 10 2023(Updated: )

Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

Credit: secure@citrix.com secure@citrix.com

Affected SoftwareAffected VersionHow to fix
Citrix NetScaler Application Delivery Controller>=12.1<12.1-55.300
Citrix NetScaler Application Delivery Controller>=12.1<12.1-55.300
Citrix NetScaler Application Delivery Controller>=13.0<13.0-92.19
Citrix NetScaler Application Delivery Controller>=13.1<13.1-37.164
Citrix NetScaler Application Delivery Controller>=13.1<13.1-49.15
Citrix NetScaler Application Delivery Controller>=14.1<14.1-8.50
Citrix NetScaler Gateway>=13.0<13.0-92.19
Citrix NetScaler Gateway>=13.1<13.1-49.15
Citrix NetScaler Gateway>=14.1<14.1-8.50
Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC
Citrix NetScaler Gateway

Remedy

Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

  • What is CVE-2023-4966?

    CVE-2023-4966 is a buffer overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that allows for sensitive information disclosure when configured as a Gateway or AAA virtual server.

  • What software is affected by CVE-2023-4966?

    Citrix NetScaler ADC and NetScaler Gateway versions 12.1-55.300 to 14.1-8.50 are affected by CVE-2023-4966.

  • What is the severity of CVE-2023-4966?

    CVE-2023-4966 has a severity rating of 7.5 (Critical).

  • How can I fix CVE-2023-4966?

    Citrix has released security bulletins and patches for CVE-2023-4966. It is recommended to apply the relevant patches or updates provided by Citrix.

  • Where can I find more information about CVE-2023-4966?

    You can find more information about CVE-2023-4966 on the official Citrix support website: https://support.citrix.com/article/CTX579459

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203