New Snort rules protect against recently discovered Citrix vulnerability
Summary: Cisco Talos released Snort and Firepower signatures, available since Dec. 24, 2019, to detect exploitation attempts against CVE-2019-19781, a directory traversal vulnerability in Citrix Application Delivery Controller and Citrix Gateway that can allow a remote attacker to execute arbitrary code. No public patch had been released at the time of writing, Citrix had issued mitigation recommendations, and multiple proof-of-concept tools plus reports of mass-scanning and exploitation activity were already circulating.
What you should know: A critical Citrix flaw with public exploit tools and confirmed mass scanning in the wild had no vendor patch, leaving detection signatures as the stopgap for internet-facing ADC and Gateway systems.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2019-19781
- Related
- Threat Advisory: NSA SVR Advisory Coverage Cyber Risks ·CVE-2019-19781: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021