Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiNAC, and FortiProxy

Fortinet has introduced security updates to handle 40 vulnerabilities in its software program lineup, together with FortiWeb, FortiOS, FortiNAC, and FortiProxy, among the other folks.

Two of the 40 flaws are rated Critical, 15 are rated Superior, 22 are rated Medium, and one particular is rated Very low in severity.

Major of the checklist is a intense bug residing in the FortiNAC network entry management answer (CVE-2022-39952, CVSS rating: 9.8) that could guide to arbitrary code execution.

“An exterior handle of file name or path vulnerability [CWE-73] in FortiNAC web server may possibly allow for an unauthenticated attacker to perform arbitrary publish on the process,” Fortinet explained in an advisory before this 7 days.

The goods impacted by the vulnerability are as follows –

• FortiNAC edition 9.4.
• FortiNAC edition 9.2. by way of 9.2.5
• FortiNAC edition 9.1. via 9.1.7
• FortiNAC 8.8 all versions
• FortiNAC 8.7 all versions
• FortiNAC 8.6 all versions
• FortiNAC 8.5 all versions, and
• FortiNAC 8.3 all variations

Patches have been launched in FortiNAC versions 7.2., 9.1.8, 9.1.8, and 9.1.8. Penetration screening organization Horizon3.ai mentioned it plans to launch a evidence-of-concept (PoC) code for the flaw “soon,” producing it critical that consumers shift speedily to use the updates.

The second flaw of be aware is a set of stack-centered buffer overflow in FortiWeb’s proxy daemon (CVE-2021-42756, CVSS rating: 9.3) that could permit an unauthenticated remote attacker to accomplish arbitrary code execution by way of specifically crafted HTTP requests.

CVE-2021-42756 impacts the below variations of FortiWeb, with fixes accessible in variations FortiWeb 6..8, 6.1.3, 6.2.7, 6.3.17, and 7.. –

• FortiWeb variations 6.4 all variations
• FortiWeb variations 6.3.16 and below
• FortiWeb variations 6.2.6 and down below
• FortiWeb versions 6.1.2 and under
• FortiWeb variations 6..7 and underneath, and
• FortiWeb versions 5.x all versions

Both equally the flaws have been internally identified and documented by its solution security workforce, Fortinet explained. Apparently, CVE-2021-42756 also appears to have been recognized in 2021 but not publicly disclosed until eventually now.

Discovered this post attention-grabbing? Stick to us on Twitter  and LinkedIn to read through much more unique articles we submit.

Some parts of this article are sourced from:
thehackernews.com