Heartbleed-Bug and Fortinet products

[TC_Hessen]

Hi, have a look at http://heartbleed.com/ - I made a test with some of our own Fortigates and with some of our customers and found, that they are affected. I tried to test the public ssl portals where valid ssl certificates have been installed. Can anyone check this please? A good site to run a test is http://possible.lv/tools/hb/

[jtfinley]

Setup the IPS rule and checked again, still shows vulnerable. Also, it' s past 5pm PST, no firmware yet.

[Quint]

A Fortinet tech told me yesterday that 5.07 would not be released until June, hence the need for a workaround and an IPS signature. So 5.07 HAS been released? and is it a full OS upgrade or just a patch for Heartbleed?

[Mike_Ferderer]

It appears that FOS 4.3.x or 4.2.x didn' t use the more current and (heartbleed)vulnerable SSL implementation and therefore requires no change or is this incorrect? Release notes in 5.0.7 don' t cover this nor does the Fortinet advisory. Thanks!

[jtfinley]

Mike - 4.3.x appears to be NOT affected by this. I have updated several Fortigates with 5.0.7 and re-ran the vuln. check and it clears.

[ede_pfau]

I' ve checked 4.2.11, 4.3.15 and 5.0.6. According to http://possible.lv/tools/hb none of these were vulnerable. But, v5 seems to use the TLS handshake, the older version don' t.

[Dave_Hall]

So 5.07 HAS been released? and is it a full OS upgrade or just a patch for Heartbleed?

Reviewed the patch notes and as far as I can tell it looks like just a patch for Heartbleed plus Fortinet boilerplate.

[rwpatterson]

Check out the build numbers. This is based on another build.

[Quint]

Has anyone found the IPS signature to work? I updated to IPS signature 4.00476 and the Fortigate still fails the Heartbleed test.

[romanr]

Hi, 5.0.7 fixes the Heartbleed vulnerability for the Fortigate itself - And the only difference from 5.0.6 is the OpenSSL implementation there - No other features added or other problems fixed! Actual IPS engine will protect SSL communication against the Heartbleed attack (for sure only if it is properly configured in your firewall policies!!) - I did test for 10+ systems and I didn' t find one yet, where IPS didn' t catch it! br, Roman

[simonorch]

I' m certainly getting hits on the IPS signature, but how accurate is the sig? i notice that the default setting for it is pass so is it going to generate false positives? A word of warning, ask TAC before you consider patching if you' re running a post patch6 interim build. I' ve got one customer on build 274 because of an httpsd bug and we can' t patch to this release, even though the bug is due to be fixed in patch 7 GA and this openssl patch is being called 7.