X
NEXT
Forgot password?

Threat Intelligence: FortiOS Heap based buffer overflow

Threat Intelligence from DigitalXRAID’s Security Operations Centre analysts: 

Fortinet have recently patched a critical heap-based buffer overflow vulnerability residing in FortiOS SSL-VPN. The vulnerability may allow threat actors to remotely execute arbitrary code without authentication, via specially crafted requests. 

The CVSS (Common Vulnerability Scoring System) Severity Score has been rated as: 9.3 

Read more about the CVE detail here: CVE-2022-42475 

The affected products are listed below: 

  • FortiOS version 7.2.0 through 7.2.2 
  • FortiOS version 7.0.0 through 7.0.8 
  • FortiOS version 6.4.0 through 6.4.10 
  • FortiOS version 6.2.0 through 6.2.11 
  • FortiOS version 6.0.0 through 6.0.15 
  • FortiOS version 5.6.0 through 5.6.14 
  • FortiOS version 5.4.0 through 5.4.13 
  • FortiOS version 5.2.0 through 5.2.15 
  • FortiOS version 5.0.0 through 5.0.14 
  • FortiOS-6K7K version 7.0.0 through 7.0.7 
  • FortiOS-6K7K version 6.4.0 through 6.4.9 
  • FortiOS-6K7K version 6.2.0 through 6.2.11 
  • FortiOS-6K7K version 6.0.0 through 6.0.14 

Fortinet are aware that the vulnerability has been exploited in the wild, and recommend validating your systems against the following IoCs if running a vulnerable version of FortiOS: 

Multiple log entries with: 

Logdesc=”Application crashed” and msg=”[…] application:sslvpnd,[…], Signal 11 received, Backtrace: […]“ 

Presence of the following artifacts in the filesystem: 

/data/lib/libips.bak
/data/lib/libgif.so
/data/lib/libiptcp.so
/data/lib/libipudp.so
/data/lib/libjepg.so
/var/.sslvpnconfigbk
/data/etc/wxd.conf
/flash 

Connections to suspicious IP addresses from the FortiGate: 

  • 188.34.130.40:444 
  • 103.131.189.143:30080,30081,30443,20443 
  • 192.36.119.61:8443,444 
  • 172.247.168.153:8033 

To mitigate against this vulnerability, Fortinet recommend upgrading to one of the versions of FortiOS listed below. If this is not possible then the recommendation is to disable SSL-VPN. 

  • FortiOS version 7.2.3 or above 
  • FortiOS version 7.0.9 or above 
  • FortiOS version 6.4.11 or above 
  • FortiOS version 6.2.12 or above 
  • (upcoming) FortiOS-6K7K version 7.0.8 or above 
  • FortiOS-6K7K version 6.4.10 or above 
  • (upcoming) FortiOS-6K7K version 6.2.12 or above 
  • FortiOS-6K7K version 6.0.15 or above 

If you discover that you’ve suffered a breach as a result of this or any other vulnerability, and need help urgently, get in contact with us. You can call our emergency line on 0800 066 4509 to speak to one of our experts. They’re available 24 hours a day, 7 days a week. Bookmark this page in case you ever need us.    

If you need any support in mitigating any risks this vulnerability may have on your business, please don’t hesitate to get in contact. 

Cyber Security Experts

Accredited and regulated, we're in the top 1% of cyber security agencies globally

Crown Commercial Service Supplier Cyber Essentials Plus ISO 27001 BSI ISO 9001 CHECK NCSC Cyber Incident Response CREST

We’re trusted by the UK Government as Crown Commercial Service providers as well as being accredited by two of the leading cyber security governing bodies. Our ISO9001 certification means you can rest assured our processes and approach are market leading.

Protect Your Business & Your Reputation.

With a continued focus on security, you can rest assured that breaches and exploits won't be holding you back.

Speak To An Expert

Threat Intelligence: FortiOS Heap based buffer overflow
x

Get In Touch

[contact-form-7 id="5" title="Contact Us Form"]