Fortinet - Security vulnerabilities fixed in FortiGate, FortiWeb & FortiDeceptor
Fortinet
Fortinet has released updates to FortiOS on several of its products this week, fixing various security vulnerabilities and issues. It is recommended that all customers apply these updates. If you are on an older version and are not sure which update path is the correct one, then you can use Fortinet's Upgrade Path Tool. This will tell you whether you can update directly to the new version or whether you first have to carry out one or more intermediate updates.
The devices affected include the FortiDeceptor. This is similar to a honeypot in that it can fake worthwhile targets for attackers and monitor the attacks without them endangering the network.
FortiWeb is a web application firewall that directly protects your company's applications that are accessible via the internet. Machine Learning is also used to assess the behaviour in the company.
FortiGate is a firewall that not only takes over classic firewall tasks, but can also check traffic directly for malware with NGFW (Next-Generation-Firewall) functionality and offer extended functionality such as web filter, VPN gateway and WLAN controller.
With the FortiDeceptor, for example, it is possible to execute arbitrary code in the device. However, the attacker must be logged in to the device, i.e. already have access to the interface.
Nevertheless, Fortinet rates this vulnerability with a threat level of "high" (FortiDeceptor is impacted by an OS command injection vulnerability). The vulnerability was fixed with the updates to version 3.0.2, 3.1.1 and 3.2.0.
Four vulnerabilities were fixed in the FortiWeb web application firewall, all of which were rated with a "medium" threat level. These vulnerabilities could be used to carry out DoS attacks or, in the worst case, even execute malicious code on the device. These devices should be updated to version 6.2.4, 6.3.6 or 6.3.8.
The FortiWeb security vulnerabilities:
FortiWeb is vulnerable to a Format string vulnerability
FortiWeb is vulnerable to a buffer overflow
Stack-Based Buffer Overflow vulnerability in FortiWeb
FortiWeb is vulnerable to a blind SQL injection
Most recently, an update was also published for the FortiGate firewalls. Due to a medium security vulnerability, it is possible for unauthorised persons to view log entries from other VDOMs during SSL VPN connections and to find out IP addresses and user names, for example. However, one must also be logged on to the FortiGate here. With an update to FortiOS 6.0.11, 6.2.5, 6.4.2 or newer these problems have been fixed.
FortiGate SSL VPN logs may display events of users in a different VDO
If you are interested in a Fortinet security solution, we would be happy to offer you a free initial consultation or even request a trial for you. You are welcome to contact us via phone, email or our contact form.