vulnerability in 5.0.6

[leila07]

Hello,

I have a fortigate os: 5.0.6. i know That version is affected by Heratbleed vulnerability. but, I want to know in case that the SSL is not enabled on firewall components, there will be no need to do an upgrade?. in that case, i want to know please what components or what part of configuration in the firewall use the ssl??

[jb_kalm]

Hi,

The first two that come to mind is the HTTPS management access on the interfaces and also the SSL VPN feature. There may be others than I am not aware of but maybe some more seasoned Fortinet techs can assist. So ideally you should upgrade. 

There are some things you can do to restrict the management access such as making use of the Trusted Hosts feature on your admin accounts. Also limit the number of interfaces by which you can manage the Fortigate using HTTPS.

If you're not using the SSL VPN feature then you can turn it off under Config > Features. Hopefully this completely turns it off. If someone else knows of a more sure way please comment.

Thanks,

jb

[jfuegger]

Hey there,

to protect yourself you could apply a interface policy with an ips signature for the heartbleed stuff:

ips sensor

config ips custom
  edit "OpenSSL.TLS.Heartbeat.Information.Disclosure-custom.All"
    set action block
    set comment ''
    set signature "F-SBID( --attack_id 4982; --name \"OpenSSL.TLS.Heartbeat.Information.Disclosure-custom.All\"; 
    --protocol tcp; --flow from_server; --pattern \"|18|\"; --context packet; --within 1,context;
    --byte_test 2,>,100,2,relative;)"
  next
end

config ips sensor
  edit "ssl.heartbleed"
    config entries
      edit 1
        set action reset
        set rule 4982
        set status enable
      next
    end
  next
end

Service definition

config firewall service custom
  edit "SSLVPN"
    set tcp-portrange 10443
  next
end
config firewall service group
  edit "SSL-Services"
    set member "HTTPS" "SSLVPN"
  next
end

Interface Policy

config firewall interface-policy
  edit 0
    set interface "wan1"
    set srcaddr "all"
    set dstaddr "all"
    set service "SSL-Services"
    set ips-sensor-status enable
    set ips-sensor "ssl.heartbleed"
  next
end