Technical Tip: [Critical vulnerability] Protect against heap-based buffer overflow in sslvpnd

[Carl_Windsor_FTNT]

Description

This article describes how a critical heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote, unauthenticated attacker to execute arbitrary code or commands with specifically crafted requests. See the FortiGuard page on the vulnerability for more details: https://www.fortiguard.com/psirt/FG-IR-22-398

Scope

FortiGate.

Solution

Fortinet recommends taking immediate action to mitigate this vulnerability (by disabling SSL VPN) before upgrading to the latest release, as documented in the advisory.

If a FortiGate is managed by a FortiManager, ensure that the FortiManager is upgraded to a compatible version before upgrading the FortiGate. For more information, see the FortiManager Compatibility Chart.

To search for the Crash Log indicators of compromise documented in the advisory, search the Event Logs either on the FortiGate or the FortiAnalyzer for multiple System level log events containing the following information:

Logdesc="Application crashed" and msg="[...] application: sslvpnd,[...], Signal 11 received, Backtrace: [...]“

Alternatively, execute the following command on the FortiGate CLI:

diagnose debug crashlog read

Search for multiple examples of the following:

xxxx: [ Date & Time ] <.....> firmware  [ Firmware version ]
xxxx: [ Date & Time ] <.....> application sslvpnd
xxxx: [ Date & Time ] <.....> *** signal 11 (Segmentation fault) received ***

Additionally, search for the presence of the IoC artifacts in the filesystem with the fnsysctl command: 

fnsysctl ls -l /data/lib 

/data/lib/libips.bak 
/data/lib/libgif.so 
/data/lib/libiptcp.so 
/data/lib/libipudp.so 
/data/lib/libjepg.so 

fnsysctl ls -la /var 
/var/.sslvpnconfigbk 

fnsysctl ls -l /data/etc 
/data/etc/wxd.conf 

fnsysctl ls -l / 
/flash 

If these IoCs are detected, contact customer support for assistance. 

Note:

The 'fnsysctl' command will only work when logged in as a super_admin (administrator accounts with super_admin permission profile).  

[crao]

This was very useful. Thank you for your efforts.