Citrix XenMobile 10.x Multiple Security Updates

<section>
<div><div>
<div>

<h2> Description of Problem</h2>

<div>
<div>
<div>
<p>A number of security vulnerabilities have been identified in Citrix XenMobile Server. The vulnerabilities have been assigned the following CVE numbers.</p>
<p> </p>
<p>Affecting XenMobile Server 10.7 and 10.8:</p>
<ul>
<li>CVE-2018-10653 (High): XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server</li>
<li>CVE-2018-10650 (Medium): Insufficient Path Validation Vulnerability in Citrix XenMobile Server</li>
<li>CVE-2018-10654 (Medium): Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server</li>
<li>CVE-2018-10648 (Low): Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server</li>
<li>CVE-2018-10651 (Low): Open Redirect Vulnerabilities in Citrix XenMobile Server<br /> </li>
</ul>
<p> <br /> Affecting XenMobile Server 10.7:<br /> </p>
<ul>
<li>CVE-2018-10649 (Medium): Cross-Site Scripting Vulnerability in Citrix XenMobile Server</li>
<li>CVE-2018-10652 (Medium): Sensitive Data Leakage in Citrix XenMobile Server<br /> </li>
</ul>
<p> </p>
<p>These issues have already been addressed in the Citrix Cloud service.</p>
</div>
</div>
</div>

<hr />
</div>
<div>

<h2> Mitigating Factors</h2>

<div>
<div>
<div>
<p>CVE-2018-10650 (Medium): Insufficient Path Validation Vulnerability in Citrix XenMobile Server</p>
<p>A compromised or malicious XenMobile Server administrator session is required in order to exploit this vulnerability.</p>
<p> </p>
<p>CVE-2018-10654 (Medium): Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server</p>
<p>This issue is only exposed if XenMobile Clustering has been enabled.</p>
</div>
<div>
</div>
</div>
</div>

<hr />
</div>
<div>

<h2> What Customers Should Do</h2>

<div>
<div>
<div>
<p>These vulnerabilities have been addressed with the exception of CVE-2018-10654 in new versions of Citrix XenMobile Server.</p>
<p>Citrix recommends that customers upgrade Citrix XenMobile 10.8 to Rolling Patch 2 found at <a href=“https://support.citrix.com/article/CTX234866”>https://support.citrix.com/article/CTX234866</a> and Citrix XenMobile 10.7 to Rolling Patch 3 found at <a href=“https://support.citrix.com/article/CTX234867”>https://support.citrix.com/article/CTX234867</a>.</p>
<p>Customers using XenMobile Clustering should mitigate CVE-2018-10654 by ensuring that port 45000 on the XenMobile Server nodes is not reachable from untrustworthy traffic. Port 45000 should only be accessible between XenMobile Server nodes. See <a href=“https://docs.citrix.com/en-us/xenmobile/server/system-requirements/ports.html”>https://docs.citrix.com/en-us/xenmobile/server/system-requirements/ports.html</a>.<br /> <br /> </p>
</div>
</div>
</div>

<hr />
</div>
<div>

<h2> Acknowledgements</h2>

<div>
<div>
<div>
<p>Citrix thanks the following for working with us to protect Citrix customers:</p>
<ul>
<li>Glyn Wintle and Harry Metcalfe of DXW Cyber (<a href=“https://www.dxwcyber.com/”>https://www.dxwcyber.com/</a>)</li>
</ul>
</div>
</div>
</div>

<hr />
</div>
<div>

<h2> What Citrix Is Doing</h2>

<div>
<div>
<div>
<div>
<div>
<p>Citrix is notifying customers and channel partners about this potential security issue. This article is also available from the Citrix Knowledge Center at <u> <a href=“http://support.citrix.com/”>http://support.citrix.com/</a></u>.</p>
</div>
</div>
</div>
</div>
</div>

<hr />
</div>
<div>

<h2> Obtaining Support on This Issue</h2>

<div>
<div>
<div>
<div>
<div>
<p>If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at <u> <a href=“https://www.citrix.com/support/open-a-support-case.html”>https://www.citrix.com/support/open-a-support-case.html</a></u>. </p>
</div>
</div>
</div>
</div>
</div>

<hr />
</div>
<div>

<h2> Reporting Security Vulnerabilities</h2>

<div>
<div>
<div>
<div>
<div>
<p>Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For guidance on how to report security-related issues to Citrix, please see the following document: CTX081743 – <a href=“http://support.citrix.com/article/CTX081743”>Reporting Security Issues to Citrix</a></p>
</div>
</div>
</div>
</div>
</div>

<hr />
</div>
<div>

<h2> Changelog</h2>

<div>
<div>
<div>
<table border=“1” width=“100%”>
<tbody>
<tr>
<td>Date </td>
<td>Change</td>
</tr>
<tr>
<td>21 May 2018</td>
<td>Initial publication</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>

<hr />
</div>
</div></div>
</section>