CERT-In Vulnerability Note
CIVN-2022-0471
Buffer Overflow vulnerability in FortiOS SSL-VPN
Original Issue Date:December 14, 2022
Severity Rating: CRITICAL
Software Affected
- FortiOS versions prior to 7.2.3
- FortiOS versions prior to 7.0.9
- FortiOS versions prior to 6.4.11
- FortiOS versions prior to 6.2.12
- FortiOS-6K7K versions prior to 7.0.8
- FortiOS-6K7K versions prior to 6.4.10
- FortiOS-6K7K versions prior to 6.2.12
- FortiOS-6K7K versions prior to 6.0.15
Overview
A vulnerability has been reported in FortiOS, which could allow an unauthenticated remote attacker to execute arbitrary code on the targeted system.
Description
This vulnerability exists in FortiOS due to a boundary error within the SSL-VPN. An attacker could exploit this vulnerability by sending specially crafted requests to the SSL-VPN interface.
Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Note: This vulnerability is being exploited in the wild.
Solution
Upgrade to the latest versions of FortiOS as mentioned in the vendor advisory:
https://www.fortiguard.com/psirt/FG-IR-22-398
Vendor Information
Fortiguard
https://www.fortiguard.com/psirt/FG-IR-22-398
References
Fortiguard
https://www.fortiguard.com/psirt/FG-IR-22-398
CVE Name
CVE-2022-42475
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|