Two vulnerabilities have been reported in Citrix Advanced Access Control, which can be exploited by malicious users to bypass certain security restrictions.

1) An error in the Browser-Only access feature may allow users access to certain protected resources.

2) An error in the login process may allow users access to certain protected resources.

The vulnerabilities are reported in Citrix Access Gateway deployed with Advanced Access Control 4.0 and 4.2. Access Gateway Standard Edition and Access Gateway Enterprise Edition are not vulnerable to these issues.

Solution
Apply hotfix AACE400W004:
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Citrix:
http://support.citrix.com/article/CTX111614
http://support.citrix.com/article/CTX111615

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers