Ethical Hacking News Hubb
Advertisement Banner
  • Home
  • News
  • Ethical Hackers
  • Contact
No Result
View All Result
  • Home
  • News
  • Ethical Hackers
  • Contact
No Result
View All Result
Wellnessnewshubb
No Result
View All Result
Home Ethical Hackers

Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiNAC, and FortiProxy

admin by admin
February 19, 2023
in Ethical Hackers


Feb 19, 2023Ravie LakshmananNetwork Security / Firewall

Fortinet has released security updates to address 40 vulnerabilities in its software lineup, including FortiWeb, FortiOS, FortiNAC, and FortiProxy, among others.

Two of the 40 flaws are rated Critical, 15 are rated High, 22 are rated Medium, and one is rated Low in severity.

Top of the list is a severe bug residing in the FortiNAC network access control solution (CVE-2022-39952, CVSS score: 9.8) that could lead to arbitrary code execution.

“An external control of file name or path vulnerability [CWE-73] in FortiNAC web server may allow an unauthenticated attacker to perform arbitrary write on the system,” Fortinet said in an advisory earlier this week.

The products impacted by the vulnerability are as follows –

  • FortiNAC version 9.4.0
  • FortiNAC version 9.2.0 through 9.2.5
  • FortiNAC version 9.1.0 through 9.1.7
  • FortiNAC 8.8 all versions
  • FortiNAC 8.7 all versions
  • FortiNAC 8.6 all versions
  • FortiNAC 8.5 all versions, and
  • FortiNAC 8.3 all versions

Patches have been released in FortiNAC versions 7.2.0, 9.1.8, 9.1.8, and 9.1.8. Penetration testing firm Horizon3.ai said it plans to release a proof-of-concept (PoC) code for the flaw “soon,” making it imperative that users move quickly to apply the updates.

The second flaw of note is a set of stack-based buffer overflow in FortiWeb’s proxy daemon (CVE-2021-42756, CVSS score: 9.3) that could enable an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.

CVE-2021-42756 affects the below versions of FortiWeb, with fixes available in versions FortiWeb 6.0.8, 6.1.3, 6.2.7, 6.3.17, and 7.0.0 –

  • FortiWeb versions 6.4 all versions
  • FortiWeb versions 6.3.16 and below
  • FortiWeb versions 6.2.6 and below
  • FortiWeb versions 6.1.2 and below
  • FortiWeb versions 6.0.7 and below, and
  • FortiWeb versions 5.x all versions

Both the flaws were internally discovered and reported by its product security team, Fortinet said. Interestingly, CVE-2021-42756 also appears to have been identified in 2021 but not publicly disclosed until now.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
Previous Post

File Upload Restrictions Bypass, By Using Different Bug Bounty Techniques!

Next Post

Tool That Help You On Your IR & Threat Hunting And CA

Next Post

Tool That Help You On Your IR & Threat Hunting And CA

Recommended

How to watch Swamp People season 14 online

3 months ago

DFShell – The Best Forwarded Shell

2 months ago

© 2022 Ethical Hacking News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Ethical Hackers
  • Contact

Newsletter Sign Up.

No Result
View All Result
  • Home
  • News
  • Ethical Hackers
  • Contact

© 2022 Ethical Hacking News Hubb All rights reserved.