Fortinet warns of critical flaw in its security appliance OSes, admin panels
- Reference: 1665484334
- News link: https://www.theregister.co.uk/2022/10/11/fortinet_critical_flaw/
- Source link:
[1]CVE-2022-40684 is rated 9.6/10 on the Common Vulnerability Scoring System (CVSS), meaning it is considered a critical flaw worthy of immediate attention.
FortiGuard's [2]advisory explains why the flaw scored so highly, revealing it's an authentication bypass present in FortiOS, FortiProxy, and FortiSwitchManager.
[3]
FortiOS is the operating system for Fortinet's security appliances, FortiProxy is the company's secure web proxy, and FortiSwitchManager manages Fortinet's Ethernet switches.
[4]Toyota dev left key to customer info on public GitHub page for five years
[5]Pro-Putin goons claim responsibility for blowing US airport websites offline
[6]Intel Alder Lake BIOS code leak may contain vital secrets
The flaw could allow "an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests."
Which means an unknown party could be messing with your security appliances or switches as you read this story. Indeed, Fortinet has warned that it is "aware of an instance where this vulnerability was exploited."
[7]
[8]
The company's advice is to check your device logs for the presence of an entry that reads user="Local_Process_Access" as that's an indicator of compromise. If you find that, get on the phone to Fortinet customer service.
Other customers have been urged to disable HTTP/HTTPS access in FortiOS and FortiProxy or restrict the IP addresses that can reach that interface.
[9]
FortiSwitchManager customers have only the first option: disabling the HTTP/HTTPS admin interface.
Across all three products, the next step is an upgrade of the following versions of FortiOS, FortiProxy and FortiSwitchManager, as follows:
Upgrade FortiOS version 7.2.0 through 7.2.1 to version 7.2.2
Upgrade FortiOS version 7.0.0 through 7.0.6 to version 7.0.7 or above
Upgrade FortiProxy version 7.2.0 to FortiProxy version 7.2.1 or above
Upgrade FortiProxy version 7.0.0 through 7.0.6 to FortiProxy version 7.0.7 or above
Upgrade FortiSwitchManager version 7.2.0 to version 7.2.1 or above
Upgrade FortiSwitchManager version 7.0.0 to version 7.0.71 or above
®
Get our [10]Tech Resources
[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40684
[2] https://www.fortiguard.com/psirt/FG-IR-22-377
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y0WTIKdUjYSNl@NOT8LwVAAAAJQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2022/10/11/toyota_source_code_email_leak/
[5] https://www.theregister.com/2022/10/10/ddos_us_airport_websites/
[6] https://www.theregister.com/2022/10/10/alder_lake_bios_code_leaked/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y0WTIKdUjYSNl@NOT8LwVAAAAJQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y0WTIKdUjYSNl@NOT8LwVAAAAJQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y0WTIKdUjYSNl@NOT8LwVAAAAJQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Re: Nice score !
"FortiProxy is the company's secure web proxy"
Considering the score, there's at least one word in that description that probably doesn't belong there
Re: Nice score !
The second word!
It should read "was" ;)
Security by insecurity
We had a related organisation do a cybersecurity audit on us recently, and they want us to install a magic 'security gateway' to magically improve everything for our office network (which already has all the 'usual' firewall stuff). Fortigate would be one of the potential options for this. Ho hum, I'll sit smugly and delay implementing the recommendation a little longer, then...
Re: Security by insecurity
All I know about Fortinet is our place enabled deep packet inspection on just about everything and as a consequence broke just about every development tool.
Something perverse about security that does a man in the middle attack and does as much harm to productivity as a malicious attacker would.
Who??
Who leaves their FW admin interface open to exploit?
Fortigate from the start has options to lock down the "admin IP addresses" that can access any admin protocol (ie. SNMP, GUI, SSH), just like any FW vendor..
At a minimum, lock it to your inside addresses, although would be better to restrict it just the internal IPs your network admins use.
Thats been SOP from the start for us using Fortigate. Still, something else can be used to springboard off to the device, but if your restricted IP range of who can even touch the box is a tiny footprint, the chance of exploit is greately reduced.
Also, to the Reg, FortiSwitchManager is a smashup of two different products.
There is a PSIRT for FortiSwitch when they are in a security fabric with FortiGate.
And there is a separate PSIRT for FortiManager for certain versions. They generalliy aren't mentioned together in the same breath.
Re: Who??
Who leaves their FW admin interface open to exploit?
Those who believe a security appliance might be, er, secure?
Nice score !
"CVE-2022-40684 is rated 9.6/10 on the Common Vulnerability Scoring System (CVSS), meaning it is considered a critical flaw worthy of immediate attention."
Wow, that is a serious score, in terms of belonging to the Hall of Shame !
Nice work, Fortinet !