Description
Stack-based buffer overflow in collectoragent.exe in Fortinet Single Sign On (FSSO) before build 164 allows remote attackers to execute arbitrary code via a large PROCESS_HELLO message to the Message Dispatcher on TCP port 8000.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Fortinet Single Sign On - Stack Overflow EDB-36422 · dos · Mar 18, 2015 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow
- 20150318 [CORE-2015-0006] - Fortinet Single Sign On Stack Overflow mailing-list
- 20150318 [CORE-2015-0006] - Fortinet Single Sign On Stack Overflow mailing-list
- http://www.fortiguard.com/advisory/2015-02-27-fsso-stack-based-buffer-overflow
- http://www.fortiguard.com/advisory/FG-IR-15-006/
- 73206 vdb-entry
- 36422 exploit
- 119719 vdb-entry