Heartbleed-Bug and Fortinet products

[TC_Hessen]

Hi, have a look at http://heartbleed.com/ - I made a test with some of our own Fortigates and with some of our customers and found, that they are affected. I tried to test the public ssl portals where valid ssl certificates have been installed. Can anyone check this please? A good site to run a test is http://possible.lv/tools/hb/

[billp]

I just found this IPS signature on a Fortinet blog: http://firewallguru.blogspot.com/2014/04/heartbleed-openssl-vulnerability.html Signature here: F-SBID( --name " OpenSSL.TLS.Heartbeat.Information.Disclosure" ; --protocol tcp; --flow from_client; --service SSL; --pattern " |18|" ; --context packet; --within 1,context; --byte_test 2,>,255,2,relative; ) I haven' t had a chance to test it out yet.

[TC_Hessen]

Thanks. But I have no idea where to add such a sensor. I tried to add it into the ssl-portal-policies, but that does not work. In other words, which policy protects the login-screen https://<firewall ip>/remote/login ?

[billp]

I can' t get it to work either. They just announced 5.0.7 for release tomorrow, so there' s probably no simple IPS patch that can handle this.

[KNAW]

Hello Bill, Where did you find the announcement for 5.0.7? And do you know whether it is just a fix for the Heartbleed bug or " full" patch release? Arjan

[mhe]

From Fortinet: " A firmware update for FortiOS will be available Wednesday April 9, at 5PM Pacific Daylight Time (1AM GMT Thursday April 10). Firmware updates for FortiAuthenticator and FortiMail will be available on Friday April 11th. Firmware release dates for other products are pending." martin

[Carl_Wallmark]

More info: http://www.fortiguard.com/advisory/FG-IR-14-011/

[200B]

I implemented the fix using an interface-policy. Seems to have worked based upon the testing sites that are available. The Fortinet announcement is a bit vague - it doesn' t specify exactly that the Fortigates are vulnerable, yet a patch is coming in a hurry so they must be?

[mhe]

Affected Products: FortiGate (FortiOS) 5.0 and higher, FortiAuthenticator 3.0 and higher, FortiMail 5.0 and higher, FortiVoice, and FortiRecorder. For me thats a clear statement. martin

[AndreaSoliva]

Hi official statement and Cert comunication you will find here: http://www.fortiguard.com/advisory/FG-IR-14-011/ In this comunication is also mentioned the IPS custom sig as how to configure it. also there will be some new releases: A firmware update for FortiOS will be available Wednesday April 9, at 5PM Pacific Daylight Time (1AM GMT Thursday April 10). Firmware updates for FortiAuthenticator and FortiMail will be available on Friday April 11th. Firmware release dates for other products are pending. Hope this helps have fun Andrea