PT-2021-6853 · Fortinet · Fortios
Published
2021-09-12
·
Updated
2021-12-10
·
CVE-2021-36173
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FortiOS versions 6.0.0 through 6.0.13
FortiOS versions 6.2.0 through 6.2.9
FortiOS versions 6.4.0 through 6.4.6
FortiOS versions 7.0.0 through 7.0.1
Description
The issue is related to a heap-based buffer overflow in the firmware signature verification function of FortiOS. This overflow can be exploited by an attacker to execute arbitrary code via specially crafted installation images.
Recommendations
For FortiOS versions 6.0.0 through 6.0.13, update to a version that fixes the heap-based buffer overflow in the firmware signature verification function.
For FortiOS versions 6.2.0 through 6.2.9, update to a version that fixes the heap-based buffer overflow in the firmware signature verification function.
For FortiOS versions 6.4.0 through 6.4.6, update to a version that fixes the heap-based buffer overflow in the firmware signature verification function.
For FortiOS versions 7.0.0 through 7.0.1, update to a version that fixes the heap-based buffer overflow in the firmware signature verification function.
As a temporary workaround, consider restricting the use of the firmware signature verification function until a patch is available.
Fix
Heap Based Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fortios