NetScaler ADC vulnerabilities

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to version-specific requirements: for versions 14.1-73.37 through 14.1-73.41 inclusive, 14.1-FIPS 14.1-73.37 FIPS through 14.1-73.41 FIPS inclusive, 13.1-64.23 through 13.1-64.28 inclusive, and 13.1-FIPS 13.1-NDcPP 13.1-37.279 through 13.1-37.282 inclusive — applicable only when configured as a SAML IdP; for versions before 14.1-73.37, 14.1-FIPS before 14.1-73.37 FIPS, before 13.1-64.23, and 13.1-FIPS before 13.1-NDcPP 13.1-37.279 — applicable when configured as a SAML SP or SAML IdP.

Multiple memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway can lead to unpredictable or erroneous behavior and Denial of Service (DoS). The vulnerability occurs when NetScaler ADC is configured as an Oracle load balancer, DNS proxy, or DNS recursive resolver.

Insufficient input validation in NetScaler ADC and NetScaler Gateway leads to memory overread when the device is configured as a SAML IDP.

The vulnerability allows a DoS attack via malformed HTTP/2 requests to NetScaler ADC and NetScaler Gateway. It occurs when HTTP/2 is enabled in the HTTP profile and associated with a virtual server (LB, CS, VPN) or a service configured on the device.