Bad news: Windows security cert SNAFU exploits are all over the web now. Also bad: Citrix gateway hole mitigations don't work for older kit

Bad news: Windows security cert SNAFU exploits are all over the web now. Also bad: Citrix gateway hole mitigations don't work for older kit

Good news: There is none. Well, apart from you can at least fully patch the Microsoft blunder


Vid Easy-to-use exploits have emerged online for two high-profile security vulnerabilities, namely the Windows certificate spoofing bug and the Citrix VPN gateway hole. If you haven't taken mitigation steps by now, you're about to have a bad time.


While IT admins can use the proof-of-concept exploit code to check their own systems are secure, miscreants can use them to, in the case of Citrix, hijack remote systems, or in the case of Windows, masquerade malware as legit apps or potentially intercept encrypted web traffic. Patches are available from Microsoft for the Windows vulnerability and should be deployed as soon as possible.


For Citrix, it will not be fully patched until January 20, and in the meantime, in certain cases, the official mitigations are not sufficient to thwart ..

Support the originator by clicking the read the rest link below.