Hello, welcome to the Wednesday, September 23rd, 2020 edition of the Sandcent, Sunsetter Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Citrix published a new version of the Citric Application Device Controller, Citrix ADC, Citrix Gateway, and Citrix SDWAN.

Now, these are, of course, products that we have seen attacked really aggressively over the last year.

So any update to these products should be taking serious, even though in this case, the vulnerabilities

aren't really all that critical.

We have three vulnerabilities that are being addressed with this update, CVE 2020-8245.

This is an HTML injection attack against the SSVPN web portal.

It's probably the easiest out of the three to exploit.

And essentially, the way this would be exploited is if an authenticated user,

so a user that's connected to the SSVPN is visiting a malicious web page,

content from that web page could be injected.

So that's basically how the attack would work.

And I don't think it's a stretch to believe that this would be not that difficult to pull off.

Next, CVE 2020, 8246.

This is denial of service attack attack, does require access to the management network, but in the past we have often seen that being exposed. No authentication required in this case, but again, only a denial of service.

CVE 2020, 8247, there's an escalation of prologge attack, again on the management interface,

and the attacker must have the privilege to execute operator commands on the management interface

in order for this to matter. Once the attacker has the privilege to execute the operator commands on the management interface in order for this to matter. Once the attacker has

the privilege to execute arbitrary commands, probably the escalation of privileges is not

really all that big of a deal anymore. So in short, apply the patch, but not an emergency.

And for Firefox users, there is an update for you Firefox 81. Aside from offering a few new features, this version of Firefox also fixes a total of six different vulnerabilities, some of which could potentially lead to arbitrary code execution.

...