@campuscodi it’s not Citrix doing the notification, and they’re not saying to take offline. They haven’t actually told customers anything. It’s coming from gov circles. Vuln is real though, I checked.
Sorry, you cannot view this.
It may have been deleted, or you may not have permission to see it.
0 Boosts
0 Likes
@GossiTheDog @campuscodi They have indeed confirmed the vulns to customers. But not the shutdown advice.
@campuscodi IMO this does not meet the threshold for "confirmation." Yes it's reliable sources of hearsay, but still hearsay without even citing an anonymous source or further details.
I can not expect to convince an engineering team to power off critical devices based on three social media posts without sourcing.
This comment is unavailable. It may have been deleted or is not visible to you.
@campuscodi Still no attribution for the information at all, but better than nothing.
And to be clear, my issue is with the state of this ecosystem, not how you're handling it.
@mttaggart @campuscodi We would agree, and would encourage all Citrix customers to voice their opinions on how this has been handled.
There are reasons information can't be attributed and fully understand why that can make it hard to leverage with other teams, but our view is that the bigger challenge is the continued poor handling of vulnerability comms by Citrix.
This comment is unavailable. It may have been deleted or is not visible to you.
@neurer @campuscodi Other than timing, there appears to be no clear connection. The claim here is a 0-day in Netscalers directly.
@campuscodi Confirmation 3: https://infosec.exchange/@ifin/117339983670607141