Fortios Versions Upgrade Still The
Fortios Versions Code Execution May
Fortios Versions Password Of An

Fortios Versions Code Execution May

Arbitrary code execution may be theoretically possible, albeit practically very difficult to achieve in this context.

Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used.

Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx being used.

An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.

All FortiGate versions with IPS configured in proxy mode (the default mode) are not affected.

NOTE: FG-IR-15-002 says The FortinetFactory certificate is unique to each device.

Use of this information constitutes acceptance for use in an AS IS condition.

There are NO warranties, implied or otherwise, with regard to this information or its use.

It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content.

EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site.

All of the vulnerabilities impacting Fortinet were fixed in April and May of 2019.

It could also potentially allow remote code execution on FortiOS due to a failure to handle JavaScript href content properly.

Fortios Versions Password Of An

That function had been inadvertently bundled into the general FortiOS release, and an Improper Authorization vulnerability resulted in that value being usable on its own to remotely change the password of an SSL VPN web portal user without credentials.

The errant code string has also been removed from the FortiOS code base.

A patch has also been released for all affected versions of FortiOS for this vulnerability.

FortiGuard signatures have also been deployed to monitor attack traffic in the wild and enable a FortiGuard response.

FortiGuard Labs continues to actively monitor attack activity worldwide and will provide additional updates when necessary.

Fortios Versions Upgrade Still The

We urge customers to immediately implement all appropriate patch updates and signatures, with a firmware upgrade still the primary recommended solution.