PT-2023-3229 · Fortinet · Fortiproxy+1

Published 2023-06-12 · Updated 2024-12-10 · CVE-2023-29179

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 6.4.0 through 6.4.12 Fortinet FortiOS versions 7.0.0 through 7.0.11 Fortinet FortiOS versions 7.2.0 through 7.2.4 Fortiproxy versions 7.0.0 through 7.0.10 Fortiproxy versions 7.2.0 through 7.2.4

Description A null pointer dereference issue allows an attacker to cause a denial of service via specially crafted HTTP requests to the /proxy endpoint. This can be exploited by a remote attacker to crash the SSL-VPN daemon.

Recommendations For Fortinet FortiOS versions 6.4.0 through 6.4.12, update to a version that includes the fix for this issue. For Fortinet FortiOS versions 7.0.0 through 7.0.11, update to a version that includes the fix for this issue. For Fortinet FortiOS versions 7.2.0 through 7.2.4, update to a version that includes the fix for this issue. For Fortiproxy versions 7.0.0 through 7.0.10, update to a version that includes the fix for this issue. For Fortiproxy versions 7.2.0 through 7.2.4, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the /proxy endpoint to minimize the risk of exploitation.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2023-03350

CVE-2023-29179

Affected Products

Fortios

Fortiproxy

References · 8

• https://fortiguard.com/psirt/FG-IR-23-125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29179 · Security Note
• https://bdu.fstec.ru/vul/2023-03350 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29179 · Vendor Advisory
• https://t.me/cvenotify/103756 · Telegram Post
• https://t.me/cvenotify/72195 · Telegram Post
• https://twitter.com/CVEnew/status/1760603505092403574 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023061312 · Note