Citrix Receiver Update 10.13.3

by

downloadWhy can't I download this file?
The vulnerability has the following identifier:
CVE IDDescriptionVulnerability TypePre-conditions
CVE-2021-22907Local privilege EscalationCWE-284: Improper Access ControlLocal user access to a system where Citrix Workspace App for Windows has been installed by an account with administrator privileges

This vulnerability affects all supported versions of Citrix Workspace app for Windows but does not affect Citrix Workspace app on any other platforms. Citrix Workspace app downloaded from Windows Store is also not affected by this issue.

Downloads - Download Citrix Products - Citrix


Cached

Mitigating Factors

This vulnerability only exists if Citrix Workspace app was installed using an account with local or domain administrator privileges. It does not exist when a standard Windows user installed Citrix Workspace app for Windows.
Users with automatic updates enabled will automatically be updated to a fixed version.

What Customers Should Do

The issue has been addressed in the following versions of Citrix Workspace app for Windows:
  • Citrix Workspace App 2105 and later
  • Citrix Workspace App 1912 LTSR CU4 and later cumulative updates
Citrix strongly recommends that customers upgrade to a fixed version as soon as possible or check if the version they are running has been automatically updated.
The latest version of Citrix Workspace app for Windows is available from the following Citrix website location:
https://www.citrix.com/downloads/workspace-app/windows/

See Full List On Support.citrix.com


The latest LTSR version of Citrix Workspace app for Windows is available from the following Citrix website location:
https://www.citrix.com/downloads/workspace-app/workspace-app-for-windows-long-term-service-release/.

Receiver 4.12 For Windows - Citrix

Acknowledgements

Citrix would like to thank Sai Cheng of Syclover Security Team for working with us to protect Citrix customers.

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential security issue. This article is also available from the Citrix Knowledge Center at http://support.citrix.com/.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at https://www.citrix.com/en-gb/support/open-a-support-case/.

Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For details on our vulnerability response process and guidance on how to report security-related issues to Citrix, please see the following webpage: – https://www.citrix.com/about/trust-center/vulnerability-process.html

Disclaimer

This document is provided on an 'as is' basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. Citrix reserves the right to change or update this document at any time.

Changelog

DateChange
2021-05-11Initial Publication
2021-05-11CVE ID Corrected
2021-05-18

Acknowledgements amended.

Added clarification that versions installed by using an account with administrator privileges are vulnerable

2021-05-19Added clarification that Citrix Workspace App in Windows Store