- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fortinet PSIRT Advisory FG-IR-18-100
Hello Fortinet users,
have you read https://fortiguard.com/psirt/FG-IR-18-100 and https://seclists.org/bugtraq/2019/Nov/38 already?
The author of the vulnerability suggests that all information of traffic that is analyzed by "FortiGuard AntiVirus", "FortiGuard AntiSpam" and "FortiGuard Web Filter" is being transfered to Fortinet´s server => really?
There is no limitation mentioned on the homepage of the author, i.e. "FortiCloud logging enabled".
We currently use: - Fortigate Firewalls with FortiOS 6.0.7 - Web Rating Overrides - SSL inspection is enabled - Antivirus-Monitoring WITHOUT "FortiSandbox Cloud for Inspection" - Anti-Spam WITHOUT "Spam Submission" option We don´t use: - FortiCloud for logging So I´m ask myself if we were ever affected by this issue at all? Does someone knows more?
Solved! Go to Solution.
- Labels:
-
6.0
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
and kinda weird that the responsible disclosure seemed to have "waited" for the fix in 6.0.7 which then doesn't be the case, communication didnt go optimal here unfortunately.
hoping on that 6.0.x fix to make everyone at ease. the issue doesnt feel that bad, but you want it solved.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like the 6.2.x GUI option under System / FortiGuard called "FortiGuard Filtering Protocol" has been back-ported to 6.0.8+. As Tanr noted and mentioned in the Upgrade Information of the release notes, you do have to set this manually (either by command line or in the GUI) to take advantage of secure FortiGuard communication if you are upgrading a config to 6.0.8. If you are starting with a fresh/new or factory-reset 6.0.8+ build, HTTPS is the new default instead of UDP.
Russ
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The PSIRT says 6.0.7 is still vulnerable, but the seclist says 6.0.7 is one of the "Solution" versions.
Anybody have a direct answer on this from Fortinet?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Solutions
Upgrade to FortiOS 6.2.0 Upgrade to FortiClientWindows 6.2.0 Upgrade to FortiClientMac 6.2.2
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, that's from the PSIRT, and in the seclist entry it says:
Solution: --------- The vendor provides updated versions for the affected products: * FortiOS 6.0.7 or 6.2.0 * FortiClientWindows 6.2.0 * FortiClientMac 6.2.2
Note that 6.2.x is not a solution for most. I don't consider it stable enough to use in production yet.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Feedback I received from Support:
"All FOS below 6.2.0 INCLUDING fos 6.0.7 are still affected with this vulnerability and the only available solution to mitigate this vulnerability for now would be to upgrade to FOS 6.2.0 onward. However, we have requested backport fix to have it included in FOS 6.0 but it is still under discussion with Engineering team."
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well given the 6.2 state of play (doesn't seem ready to go live to me) I think it's imperative that Forti engineering release a down-level update for 6.0.x stream.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
and kinda weird that the responsible disclosure seemed to have "waited" for the fix in 6.0.7 which then doesn't be the case, communication didnt go optimal here unfortunately.
hoping on that 6.0.x fix to make everyone at ease. the issue doesnt feel that bad, but you want it solved.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
agreed on impact assessment - not the kind of thing you want to have a security product doing but not a critical-to-update issue
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FYI, received the below from Support today.
"The fix is planned to be included in FOS 6.0.8 (expected release date: any time this week/ beginning of next week) and FOS 5.6.12 which will be expected to be released end of next week."