Klassifizierung
CVSS v4.0 Base Score: 8.5
Attack Vector: Privilege Escalation
Impact: Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
Pre-requisites: Local access to the target system
Betroffene Versionen
- Citrix Virtual Apps and Desktops versions before 2402
Workarounds
Citrix strongly recommends that customers upgrade their Windows Virtual Delivery Agent to versions that contain the fixes as soon as possible.
Windows Virtual Delivery Agent versions that contain the fixes are:
Current Release (CR)
- Citrix Virtual Apps and Desktops 2402 and later versions
Long Term Service Release (LTSR)
- Citrix Virtual Apps and Desktops 1912 LTSR CU9 and later cumulative updates
- Citrix Virtual Apps and Desktops 2203 LTSR CU5 and later cumulative updates
- Citrix Virtual Apps and Desktops 2402 LTSR
Maßnahmen
Updates wenn betroffene Versionen im Einsatz
IOCs
-
Quellen
Windows Virtual Delivery Agent for CVAD and Citrix DaaS Security Bulletin CVE-2024-6151