CVE-2020-15853

supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. This takes quite a while to run, and zodbot stops responding to requests during this time...

Command injection

supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. This takes quite a while to run, and zodbot stops responding to requests during this time...

CVE-2020-15853

supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. This takes quite a while to run, and zodbot stops responding to requests during this time...

While using FAS application launch fails with error "Cannot start app <Application Name>"

Application launch fails with error "Cannot start app ", Event ID 1 and 28 are logged on Storefront servers. Event ID: 1 Description: The Federated Authentication Server at: returned a server error: 1 for method AssertIdentity...

Design/Logic Flaw

Citrix Federated Authentication Service FAS 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module TPM to incorrectly store that key in the Microsoft Software Key Storage Provider MSKSP. This issue only...

CVE-2022-26355 Citrix Federated Authentication Service (FAS)

Citrix Federated Authentication Service FAS 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module TPM to incorrectly store that key in the Microsoft Software Key Storage Provider MSKSP. This issue only...

CVE-2022-26355

Summary: CVE-2022-26355 affects Citrix Federated Authentication Service (FAS) versions 7.17–10.6. When deployments configure the registration authority certificate’s private key to be stored in a TPM and PowerShell is used for that configuration, the private key is incorrectly stored in the Micro...

fas-kanzlei.de Improper Access Control vulnerability OBB-2410731

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Issue launching sessions after setting up FAS Server - Event ID 101

After setting up FAS, apps / desktops are failing to launch. On FAS servers we see event ID 101. Log Name: Application Source: Citrix.Authentication.FederatedAuthenticationService Date: Date and Time Event ID: 101 Task Category: None Level: Warning Keywords: Classic User: N/A Computer: Descriptio...

'Cannot start app' when StoreFront is configured for FAS/SAML authentication

Launching an application or desktop fails with error ‘Cannot start app’ when StoreFront is configured for FAS/SAML authentication. On the Storefront servers, we see ‘Access Denied’ for AssertIdentity from FAS server. On the FAS server, we could see that CA failed to issue certificate for UPN...

After enabling MFA and FAS users may be unable to sign to Storefront published app with Anonymous account in other domain

After enabling MFA and FAS users may be unable to sign to Storefront published app with Anonymous account in other domain, with error "Incorrect Pin" Scenario: You may have Storefront, FAS Federated Authentication Service and VDAs in Domain A and there is another Domain Bhaving StoreFront and its...

NetApp: FAS 8300/8700 & AFF A400 BMC Security Advisory - US

Lenovo Security Advisory: LEN-30687 Potential Impact: Unauthorized arbitrary command execution Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2019-17274 Summary Description: NetApp reported a vulnerability in FAS 8300/8700 and AFF A400 Baseboard Management Controller BMC firmwa...

CVE-2019-17274

NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller BMC firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access...

Command injection

NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller BMC firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access...

CVE-2019-17274

The CVE-2019-17274 entry affects NetApp FAS 8300/8700 and AFF A400 BMC firmware versions 13.x prior to 13.1P1, where a default account enabled on these devices could allow unauthorized arbitrary command execution via local access. Root cause: default credential left enabled in the BMC firmware. I...

How to troubleshoot “Cannot Start App” or “Cannot start Desktop” when launching an App or Desktop

Note: This is a master overview article. The solutions for each of the root causes is present in child articles shown in the following tables. The following error is displayed when launching an app “Cannot start App” or desktop: “Cannot start Desktop” Where to Start Troubleshooting Do you get the...

Permissions required for FAS Certificate Templates

Domain computers generating many requests on Certificate Authority CA...

Federated Authentication Service High Availability and Scalability

FAS High Availability Q: How can I restrict the FAS servers available to a particular StoreFront? To do this, you edit the GPO which applies to the StoreFront. You remove unwanted FAS FQDNs from the list, but be sure to replace them with a blank space character. This will ensure that the "index"...

Using a SafeNet Network HSM to protect the Citrix FAS Authorization (RA) Key

Introduction Citrix Federated Authentication Servers FAS are security-critical and should be treated like Domain Controllers. Protecting the FAS server’s Authorization / Registration Authority RA key is one of the measures that help protect FAS server integrity. We published an official eDocs pag...

FAS Authentication fails with an error "The username or password is incorrect"

When we try launching application or desktop with FAS configured in the StoreFront, we get an error "The username or password is incorrect"...