Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX

Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX

The v6.40 release of FactoryTalk Policy Manager allowed the private keys to be insecurely stored with read and execute privileges for the Windows group, ‘Everyone'. These keys are used to generate digital certificates and pre-shared keys. This vulnerability could allow a malicious user with access to the machine to obtain private keys. If obtained, a malicious user could impersonate resources on the secured network. An exposure of sensitive information vulnerability exists in the FactoryTalk System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.

Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Citrix Systems NetScaler ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.