Fortinet Releases Multiple Security Advisories

The security advisories address a critical vulnerability in FortiClientLinux, a high vulnerability in FortiClientMac, and a high vulnerability in FortiOS and FortiProxy.

Threat ID:: CC-4475
Threat Severity:: Medium
Published:: 10 April 2024 1:25 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

The security advisories address a critical vulnerability in FortiClientLinux, a high vulnerability in FortiClientMac, and a high vulnerability in FortiOS and FortiProxy.

Affected platforms

The following platforms are known to be affected:

Fortinet FortiOS

6.0 all versions
6.2.0 through 6.2.15
6.4.0 through 6.4.14
7.0.0 through 7.0.12
7.2.0 through 7.2.6
7.4.0 through 7.4.1

Fortinet FortiProxy

1.0 all versions
1.1 all versions
1.2 all versions
2.0 all versions
7.0.0 through 7.0.13
7.2.0 through 7.2.7
7.4.0 through 7.4.1

Fortinet FortiClient

FortiClientLinux versions:

7.0.3 through 7.0.4
7.0.6 through 7.0.10
7.2.0

FortiClientMac versions:

7.0.6 through 7.0.10
7.2.0 through 7.2.3

Threat details

Introduction

Fortinet has released security advisories to address multiple vulnerabilities.

The security advisories address one critical vulnerability in FortiClientLinux, one high vulnerability in FortiClientMac, and one high vulnerability in the SSL-VPN component of FortiOS and FortiProxy. FortiClient, FortiOS, and FortiProxy all provide a virtual private network solution.

Vulnerability details

CVE-2023-45590 - CWE-94 - Code Injection

CVE-2023-45590 is an improper control of generation of code vulnerability in FortiClientLinux with a CVSSv3 score of 9.4. An unauthenticated attacker could exploit this vulnerability to execute arbitrary code.

CVE-2023-45588 & CVE-2024-31492 - CWE-73 - External Control of File Name or Path

CVE-2023-45588 and CVE-2024-31492 are external control of file name or path vulnerabilities in FortiClientMac's installer with a CVSSv3 score of 7.8. A local attacker could exploit these vulnerabilities to execute arbitrary code by writing a malicious configuration file in the /tmp directory before starting the installation process.

CVE-2023-41677 - CWE-522 - Insufficiently Protected Credentials

CVE-2023-41677 is an insufficiently protected credentials vulnerability in the SSL-VPN component of FortiOS and FortiProxy with a CVSSv3 score of 7.5. A remote unauthenticated attacker could exploit this vulnerability to obtain the administrator cookie if a malicious link is clicked.

Remediation advice

Affected organisations are encouraged to review the following Fortinet Security Advisories below and apply the relevant updates.

Remediation steps

Type	Step
Patch	FortiClientLinux - Remote Code Execution due to dangerous nodejs configuration (Critical) https://fortiguard.fortinet.com/psirt/FG-IR-23-087
Patch	FortiClientMac - Lack of configuration file validation (High) https://fortiguard.fortinet.com/psirt/FG-IR-23-345
Patch	FortiOS & FortiProxy - administrator cookie leakage (High) https://www.fortiguard.com/psirt/FG-IR-23-493

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2023-45590

An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows attacker to execute unauthorized code or commands via tricking a FortiClientLinux user into visiting a malicious website.

Status Published

CVE-2023-41677

A insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17 allows attacker to execute unauthorized code or commands via targeted social engineering attack .

Status Reserved

CVE-2023-45588

Status Reserved

CVE-2024-31492

Last edited: 10 April 2024 1:25 pm