Light

Episode #946 Quiz

Citrix Bleed
Date: 2023-10-31 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Citrix Bleed (CVE-2023-4966) affected Citrix NetScaler ADC/Gateway. Assetnote reverse engineered patched nsppe binaries with Ghidra/BinDiff and found an unauthenticated OpenID endpoint using snprintf safely, then wrongly reusing snprintf’s returned required length as the response size. This overread leaked adjacent RAM, including session tokens, enabling authentication bypass and mass exploitation.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the ADAMnetworks whitelist architecture described this episode, what is the role of the outbound firewall component called "Don't Talk to Strangers"?

Question 1

In the ADAMnetworks whitelist architecture described this episode, what is the role of the outbound firewall component called "Don't Talk to Strangers"?

It blocks any outbound connection to domains that appear on a shared malicious-domain blacklist. It inspects packet payloads for malicious content before permitting the connection to proceed. It blocks any outbound connection to an IP that was not first resolved by the local DNS resolver. It allows any connection that matches a previously observed TLS certificate fingerprint.

Question 2: What exact mistake in the Citrix NetScaler code caused the Citrix Bleed information leak?

Question 2

What exact mistake in the Citrix NetScaler code caused the Citrix Bleed information leak?

A user-controlled header was inserted directly into the response without any formatting function. The OpenID endpoint accepted unauthenticated requests without any access control before generating output. A post-snprintf length check was missing before using the returned size to send the response. A memcpy call copied more bytes than the destination buffer could hold after formatting the reply.

Question 3: According to Assetnote’s analysis, what attacker-controlled input actually let the response grow large enough to trigger the leak?

Question 3

According to Assetnote’s analysis, what attacker-controlled input actually let the response grow large enough to trigger the leak?

The DNS name configured on the appliance by an administrator. The authenticated username stored in the gateway’s session database. The client’s TLS SNI value presented during handshake. The HTTP Host header supplied by the remote requester.

Question 4: What additional property of the NetScaler code made the Citrix Bleed attack practical once the length check was absent?

Question 4

What additional property of the NetScaler code made the Citrix Bleed attack practical once the length check was absent?

The buffer size was reduced to 64K in the patched version. The endpoint required a secondary request to fetch the leaked memory. The endpoint compressed the response before sending it. The hostname was inserted into the payload six separate times.

Question 5: What happened on Sunday in Steve’s SpinRite 6.1 work, according to the episode?

Question 5

What happened on Sunday in Steve’s SpinRite 6.1 work, according to the episode?

SpinRite 7 development officially began. The Windows-side boot media builder was completed and shipped. The second and possibly final pre-release was published. All existing SpinRite 6.0 users were notified by email.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.