Summary
Fortinet heeft meerdere kwetsbaarheden verholpen in FortiAuthenticator versies 6.6.0 tot 6.6.10 en 8.0.0 tot 8.0.3.
Details
Interpretaties
Meerdere kwetsbaarheden in FortiAuthenticator kunnen leiden tot ongeoorloofde toegang, informatielekken, code-uitvoering of uitval. Sommige zijn zonder account te misbruiken
- Open redirect: doorsturen van gebruikers naar ongewenste websites.
- Dienstverstoring: uitval door oneindige lussen of overbelasting.
- Toegangscontrole: ongeoorloofde toegang door fouten in autorisatie en rechtenbeheer.
- FSSO: buffer overflow in de authenticatieonderdelen.
- LDAP- en SQL-injectie: manipuleren van directory- en databaseopdrachten.
- Geheugenfouten: schrijven buiten geheugenbuffers en ongeldige geheugenverwijzingen.
- Formatstringfout: onveilige verwerking van aangeleverde tekst.
- Hardcoded wachtwoorden: misbruik van vaste, ingebouwde wachtwoorden.
Oplossingen
Fortinet heeft updates uitgebracht om de kwetsbaarheden in FortiAuthenticator te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 18
-
Critical 9.1
A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 th…
-
Critical 9.0
A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0…
-
High 8.8
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiA…
-
High 8.6
A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 th…
-
High 8.3
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiA…
-
High 8.2
A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiA…
-
High 8.2
A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 th…
-
High 8.1
A out-of-bounds write vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 throug…
-
High 7.5
A loop with unreachable exit condition ('infinite loop') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0…
-
High 7.5
A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.…
-
High 7.5
A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3…
-
High 7.5
A null pointer dereference vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 t…
-
High 7.5
A insufficiently protected credentials vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthentic…
-
High 7.4
A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 th…
-
High 7.2
A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 th…
-
High 7.2
A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAut…
-
High 7.2
A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.…
-
Medium 5.8
A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3,…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-191
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-252
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-253
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-254
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-255
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-256
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-257
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-259
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-260
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-261
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-262
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-263
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-264
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-265
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-266
-
Reference
https://fortiguard.fortinet.com/psirt/FG-IR-26-271