PT-2021-3590 · Fortinet · Fortisandbox

Published 2021-06-02 · Updated 2021-07-12 · CVE-2020-29014

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FortiSandbox versions prior to 3.2.2

Description The issue is caused by a concurrent execution using shared resources with improper synchronization, also known as a 'race condition', in the command shell of FortiSandbox. This may allow an authenticated attacker to bring the system into an unresponsive state via specifically orchestrated sequences of commands.

Recommendations For versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the command shell to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2021-03694

CVE-2020-29014

Affected Products

Fortisandbox

References · 6

• https://osv.dev/vulnerability/CVE-2020-29014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29014 · Security Note
• https://bdu.fstec.ru/vul/2021-03694 · Security Note
• https://fortiguard.com/advisory/FG-IR-20-185 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-20-185 · Note
• https://t.me/cvenotify/17396 · Telegram Post