Brief Statement Regarding Issues Found with FortiOS

[snanduru_FTNT]

The recent issue that was disclosed publicly was resolved and a patch was made available in July 2014 as part of Fortinet’s commitment to ensuring the quality and integrity of our codebase. This was not a “backdoor” vulnerability issue but rather a management authentication issue. The issue was identified by our Product Security team as part of their regular review and testing efforts.

After careful analysis and investigation, we were able to verify this issue was not due to any malicious activity by any party, internal or external. 

If you are using:
FortiOS v4.3.17 or any later version of FortiOS v4.3 (available as of July 9, 2014)
FortiOS v5.0.8 or any later version of FortiOS v5.0 (available as of July 28, 2014)
Any version of FortiOS v5.2 or v5.4

You are not affected by this.

If you are affected by this, Fortinet recommends you immediately update your FortiOS product.

Please refer to the Product Security Advisory posted here http://www.fortiguard.com/advisory/fortios-ssh-undocumented-interactive-login-vulnerability for further information. 

Any additional information will be made available if warranted.

Fortinet, through its Product Security team, is committed to reasonable and responsible disclosure of all vulnerabilities and security issues in its products. Fortinet encourages any and all reporters of vulnerability issues to work with Fortinet in a responsible fashion to ensure the security of our products and our customers. Anyone who wishes to report a security issue to Fortinet is encouraged to contact us through the details located at www.fortiguard.com/psirt .

[ArchUser]

CSB-160115-1 published

CSB-160115-1 has been published related to this issue.

CSBs can be found on the Support Site: https://support.fortinet.com/Information/Bulletin.aspx?section=47

[NotMine]

Fascinating

What is fascinating to me, and I must say this even though it is somewhat unprofessional, is how little attention this "issue" is getting here and on the Fortinet forum. On that same note, I do not consider this to be an "issue". It is much worse than that. The fact that a "leading provider of fast and secure cyber security solutions" would let this kind of design/implementation flaw go into production worldwide is almost unbelievable. I hold the entire company responsible for this, and here's why: Product manager(s), for adopting this kind of "solution" to a relatively simple authentication problem. Product developers for implementing this "solution". Internal product security teams for not immediately spotting and banning this obvious high-level security risk. Personally, I would much rather prefer this to have been an maliciously planted backdoor, than a design/implementation flaw. You cannot imagine how embarrassing the conversations with the customers were these days. Or can you?