PT-2023-3763 · Fortinet · Fortiproxy+1

Published 2023-06-12 · Updated 2023-06-20 · CVE-2023-29178

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions FortiProxy versions 7.2.0 through 7.2.3 and before 7.0.9 FortiOS versions 7.2.0 through 7.2.4 and before 7.0.11

Description The issue is related to an access of uninitialized pointer vulnerability. This allows an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests.

Recommendations For FortiProxy versions 7.2.0 through 7.2.3, update to a version after 7.2.3 or apply a patch if available. For FortiProxy versions before 7.0.9, update to a version 7.0.9 or later. For FortiOS versions 7.2.0 through 7.2.4, update to a version after 7.2.4 or apply a patch if available. For FortiOS versions before 7.0.11, update to a version 7.0.11 or later. As a temporary workaround, consider restricting access to the administrative interface API to minimize the risk of exploitation.

Fix

DoS

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BDU:2023-04052

CVE-2023-29178

Affected Products

Fortios

Fortiproxy

References · 6

• https://fortiguard.com/psirt/FG-IR-23-095 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04052 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-29178 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29178 · Vendor Advisory
• https://vuldb.com/?id.231304 · Note
• https://t.me/cvenotify/52731 · Telegram Post