Citrix NetScaler Keeps Rebooting Following the 0-Day Patch

What happened?

Citrix NetScaler customers are reporting repeated appliance reboots after installing build 14.1-73.37, the emergency update released for two zero-day flaws under active attack. The failures appear linked to crafted SAML authentication traffic that crashes the nsaaad service. Citrix says its engineering and support teams are tracking a newly seen SAML issue and plan to release a fresh security bulletin and fixed build. The key point is that the reboot reports do not yet prove attackers have bypas

Key details

• Citrix NetScaler appliances reboot after installing build 14.1-73.37
• Crafted SAML traffic crashes the nsaaad service causing reboots
• Build 14.1-73.37 patches two zero-day vulnerabilities under active exploitation
• First flaw allows unauthenticated remote command execution
• Second flaw allows code execution or denial of service with DTLS enabled

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.