CVE-2022-30190 Follina

[hannahccx]

Hi Team, does the fortimail have deep content filtering within the attachments it scans to filter and quarantine word docs that may be looking to exploit CVE-2022-30190?

If so, are there already signatures/profiles that can be applied? FortiMail  #follina

[AEK]

I don't have precise response on this precise CVE, but basically you have these two scenarios:

1.  Doc file has a known malware exploiting vulnerability CVE-XXXX-XXXXX, and this known malware has a known signature -> Then FML can block it with AV policy
2. Doc file has an unknown malware or malware of advanced threat category (e.g. Zero day, metamorphic, ...) -> Then FML is not able to detect it by its own, and you need a SandBoxing appliance instead

Hope it helps

[hannahccx]

Thank you for the reply.

In regards to scenario 1:

a) is there an ability to do custom signatures?
b) if not, how can I see if fortimail has already developed a signature for a particular CVE?

[AEK]

Hello

a> I don't know a way to add a customer signature on FML

b> The only way I know is to test it, i.e.: Send an infected doc and see if FML catches it.

Another method is possible: You can just open a ticket. I already did it to ask for a certain vulnerability and they replied.

[TyraFulcher]

Ok, thanks. I will open ticket. But not right now, I will do it later because I want to write an essay assignment and I already found https://writinguniverse.com/knowledge-base/ website online through which I am gonna take help to complete my essay assignment.

[williamwill009]

An important question about protection against CVE-2022-30190. In my experience, FortiMail does provide deep scanning of content, including attachments. Still, it's always worth checking for the latest security updates to make sure your protection is up to date. It reminded me of the challenges I faced when working on programming projects where security came first. For those facing similar challenges in their programming projects or homework, I found the author's page to be a real lifesaver. They offer help not only with writing code but also with understanding important aspects of software security.