Citrix ADC和Citrix Gateway远程代码执行漏洞安全风险通告

add authentication samlActionadd authentication samlIdPProfile

rule tricklancer_a { strings: $str1 = "//var//log//ns.log" nocase ascii wide $str2 = "//var//log//cron" nocase ascii wide $str3 = "//var//log//auth.log" nocase ascii wide $str4 = "//var//log//httpaccess-vpn.log" nocase ascii wide $str5 = "//var//log//nsvpn.log" nocase ascii wide $str6 = "TF:YYYYMMddhhmmss" nocase ascii wide $str7 = "//var//log//lastlog" nocase ascii wide $str8 = "clear_utmp" nocase ascii wide $str9 = "clear_text_http" nocase ascii widecondition: 7 of ($str*)}rule tricklancer_b { strings: $str1 = "nsppe" nocase ascii wide $str2 = "pb_policy -h nothing" nocase ascii wide $str3 = "pb_policy -d" nocase ascii wide $str4 = "findProcessListByName" nocase ascii wide $str5 = "restoreStateAndDetach" nocase ascii wide $str6 = "checktargetsig" nocase ascii wide $str7 = "DoInject" nocase ascii wide $str8 = "DoUnInject" nocase ascii wide condition: 7 of ($str*)}rule tricklancer_c { strings: $str1 = "is_path_traversal_or_vpns_attack_request" nocase ascii wide $str2 = "ns_vpn_process_unauthenticated_request" nocase ascii wide $str3 = "mmapshell" nocase ascii wide $str4 = "DoUnInject" nocase ascii wide $str5 = "CalcDistanse" nocase ascii wide $str6 = "checkMyData" nocase ascii wide $str7 = "vpn_location_url_len" nocase ascii widecondition: 5 of ($str*) }