Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.0051
Multiple vulnerabilities in FortiWeb
6 January 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: FortiWeb
Publisher: Fortiguard
Operating System: Network Appliance
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-29015 CVE-2020-29018 CVE-2020-29016
CVE-2020-29019
Original Bulletin:
https://fortiguard.com/psirt/ FG-IR-20-124
https://fortiguard.com/psirt/ FG-IR-20-126
https://fortiguard.com/psirt/FG-IR-20-123
https://fortiguard.com/psirt/FG-IR-20-125
- --------------------------BEGIN INCLUDED TEXT--------------------
FortiWeb is vulnerable to a blind SQL injection
IR Number : FG-IR-20-124
Date : Jan 04, 2021
Risk : 3/5
CVSSv3 Score: 6.4
Impact : Execute unauthorized code or commands
Summary
A blind SQL injection in the user interface of FortiWeb may allow an
unauthenticated, remote attacker to execute arbitrary SQL queries or commands
by sending a request with a crafted Authorization header containing a malicious
SQL statement.
Impact
Execute unauthorized code or commands
Affected Products
FortiWeb versions 6.3.7 and below.
FortiWeb versions 6.2.3 and below.
Solutions
Please upgrade to FortiWeb versions 6.3.8 or above.
Please upgrade to FortiWeb versions 6.2.4 or above.
Acknowledgement
Fortinet is pleased to thank Andrey Medov from ptsecurity for reporting this
vulnerability under responsible disclosure.
- ----------------------------------------------------------------------------------------------------------
FortiWeb is vulnerable to a buffer overflow.
IR Number : FG-IR-20-126
Date : Jan 04, 2021
Risk : 3/5
CVSSv3 Score: 6.4
Impact : Denial of service
Summary
A stack-based buffer overflow vulnerability in FortiWeb may allow a remote,
authenticated attacker to crash the httpd daemon thread by sending a request
with a crafted cookie header.
Impact
Denial of service
Affected Products
FortiWeb versions 6.3.7 and below.
FortiWeb versions 6.2.3 and below.
Solutions
Please upgrade to FortiWeb versions 6.3.8 or above.
Please upgrade to FortiWeb versions 6.2.4 or above.
Acknowledgement
Fortinet is pleased to thank Andrey Medov from ptsecurity for reporting this
vulnerability under responsible disclosure.
- ----------------------------------------------------------------------------------------------------------------
FortiWeb is vulnerable to a Format string vulnerability
IR Number : FG-IR-20-123
Date : Jan 04, 2021
Risk : 3/5
CVSSv3 Score: 5.3
Impact : Execute unauthorized code or commands
Summary
A format string vulnerability in FortiWeb may allow an authenticated, remote
attacker to read the content of memory and retrieve sensitive data via the
redir parameter.
Impact
Execute unauthorized code or commands
Affected Products
FortiWeb versions 6.3.5 and below.
Solutions
Please upgrade to FortiWeb versions 6.3.6 or above.
Acknowledgement
Fortinet is pleased to thank Andrey Medov from ptsecurity for reporting this
vulnerability under responsible disclosure.
- ----------------------------------------------------------------------------------------------------------
Stack-Based Buffer Overflow vulnerability in FortiWeb
IR Number : FG-IR-20-125
Date : Jan 04, 2021
Risk : 3/5
CVSSv3 Score: 6.4
Impact : Execute unauthorized code or commands
Summary
A stack-based buffer overflow vulnerability in FortiWeb may allow an
unauthenticated, remote attacker to overwrite the content of the stack and
potentially execute arbitrary code by sending a crafted request with a large
certname.
Impact
Execute unauthorized code or commands
Affected Products
FortiWeb versions 6.3.5 and below.
FortiWeb versions 6.2.3 and below.
Solutions
Please upgrade to FortiWeb versions 6.3.6 or above.
Please upgrade to FortiWeb versions 6.2.4 or above.
Acknowledgement
Fortinet is pleased to thank Andrey Medov from ptsecurity for reporting this
vulnerability under responsible disclosure.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX/UcyeNLKJtyKPYoAQjsxRAAmO6WAZWTVmbX5vtAE1SoJDetbO8erq1j
dWXfI/S+7QwEePWgAB3Z67vsaFQGkCKXGR1V/HxBDVj2XUuVs78Yl0nYMLoUeJs5
yB/MFZ80kJauO/bJvhVQVbMNpyQ0bVxv402ScIJzmicW0nEWTjFtIvAh1kl8VYDz
P87uEyQts2KtIv3LlS0xgTvyFaRB+pUxh7Xx/jL+TNg8tskVu1w5W+38G27bjZIp
JDdwpzTXS/BuSrzjqnOiAEXCEXTsmMhEmikKhTXr13AWwgmy4yN4Nhb/HWF83DZu
g0XHZvqGqLOC/WpFU3Tis/ohg3hinn9MJIK38onuOtZzM3rxJ0h/w4GFXaNpW9Bl
vaN5LXB48NtXnbGzXPFUgeJlh2+GegwNKEg43fK5Qlgby1Y7nlTFTptCAFxL7uG1
bhZpCRr5VwZi48r5BUFITbn0lO0HexEOWYCXfdJresHlQx/7loQHT34wQdiyz2MB
eicAfM6fq5xak2VE7MufdaaH8fnDKHbrsIIo4utQGY9p2wqW12gSpB7lw88xraCW
YCygk8i54vVsTicMfKyIpbqQlVAw8OTSghERfo3vXdPJ/pi/PRgA4PO3eSzPYmK/
IvEa3zwTHAJt+r1HqXdOG0kBGVsBUruUdPueJm3tGll8xL5W9cZcusJPoi4vZ4rD
8KmCE1sEJAs=
=sVQx
-----END PGP SIGNATURE-----