New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access

Mar 09, 2023Ravie LakshmananNetwork Security / Firewall

Fortinet has released fixes to address 15 security flaws^[1], including one critical
vulnerability impacting FortiOS and FortiProxy that could enable a
threat actor to take control of affected systems.

The issue, tracked as CVE-2023-25610, is rated
9.3 out of 10 for severity and was internally discovered and
reported by its security teams.

“A buffer underwrite (‘buffer underflow’) vulnerability in
FortiOS and FortiProxy administrative interface may allow a remote
unauthenticated attacker to execute arbitrary code on the device
and/or perform a DoS on the GUI, via specifically crafted
requests,” Fortinet said^[2]
in an advisory.

Underflow bugs^[3], also called buffer underruns^[4], occur when the input
data is shorter than the reserved space, causing unpredictable
behavior or leakage of sensitive data from memory.

Other possible consequences include memory corruption that could
either be weaponized to induce a crash or execute arbitrary
code.

Fortinet said it’s not aware of any malicious exploitation
attempts against the flaw. But given that prior flaws in software
have come under active abuse in the wild, it’s essential that users
move quickly to apply the patches.

The following versions of FortiOS and FortiProxy are impacted by
the vulnerability –

• FortiOS version 7.2.0 through 7.2.3
• FortiOS version 7.0.0 through 7.0.9
• FortiOS version 6.4.0 through 6.4.11
• FortiOS version 6.2.0 through 6.2.12
• FortiOS 6.0 all versions
• FortiProxy version 7.2.0 through 7.2.2
• FortiProxy version 7.0.0 through 7.0.8
• FortiProxy version 2.0.0 through 2.0.11
• FortiProxy 1.2 all versions
• FortiProxy 1.1 all versions

Fixes are available in FortiOS versions 6.2.13, 6.4.12, 7.0.10,
7.2.4, and 7.4.0; FortiOS-6K7K versions 6.2.13, 6.4.12, and 7.0.10;
and FortiProxy versions 2.0.12, 7.0.9, and 7.0.9.

As workarounds, Fortinet is recommending that users either
disable the HTTP/HTTPS administrative interface or limit IP
addresses that can reach it.

The disclosure comes weeks after the network security company
issued fixes for 40 vulnerabilities^[6], two of which are rated
Critical and impact FortiNAC (CVE-2022-39952) and FortiWeb
(CVE-2021-42756) products.