DESCRIPTION:
A heap-based buffer overflow vulnerability (CVE-2023-27997) in FortiOS and FortiProxy SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
AFFECTED RELEASES:
FortiOS-6K7K version 7.0.10, 7.0.5, 6.4.12, 6.4.10, 6.4.8, 6.4.6, 6.4.2, 6.2.9 through 6.2.13, 6.2.6 through 6.2.7, 6.2.4, 6.0.12 through 6.0.16, 6.0.10
FortiProxy version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, 2.0.0 through 2.0.12, 1.2 all versions, 1.1 all versions
FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.13, 6.0.0 through 6.0.16
SOLUTION:
1. Users and system administrators of affected products are advised to apply the security updates:
(1) Please upgrade to FortiOS-6K7K version 7.0.12, 6.4.13, 6.2.15, 6.0.17 or above
(2) Please upgrade to FortiProxy version 7.2.4, 7.0.10 or above
(3) Please upgrade to FortiOS version 7.4.0, 7.2.5, 7.0.12, 6.4.13, 6.2.14, 6.0.17 or above
2. If you can’t update to the latest version, please refer to the Fortinet official webpage for the” Workaround” part, and take action below:
(1) Disable SSL-VPN
REFERENCE:
1. https://www.fortiguard.com/psirt/FG-IR-23-097
2. https://thehackernews.com/2023/06/critical-rce-flaw-discovered-in.html?&web_view=true