what you don't know can hurt you

fortigate.txt

fortigate.txt
Posted Oct 3, 2003
Authored by Maarten Hartsuijker

Fortigate firewall pre 2.50 maintenance release 4 has multiple vulnerabilities that allow a remote attacker to gain a username and password of the system.

tags | advisory, remote, vulnerability
MD5 | 1d223ea8c072ec063dea296fbab65533

fortigate.txt

Change Mirror Download
Issue: Several vulnerabilities in web interface of Fortigate firewall of
which the most serious one will allow a remote attacker to obtain a username
and password of the Fortigate.
Release: pre 2.50 maintenance release 4
Fixed in: Fortinet OS 2.50 MR4, available from FTP as of 29 Sept. 2003
Date: 14/sept/2003
Vendor first notified: 14/sept/2003

During a review of the FortiGate firewall, I noticed several security flaws
in their webapplication. Combining two of the issues could allow a remote
attacker to obtain a username and password of the fortigate. FortiNet has
fixed one of the most serious flaws in the maintenance release 4, that is
available for customers on their FTP as off this week. Since the other
issues have not yet been fixed, I will not disclose these details at this
time.
Web filter log parses unfiltered session details:
After the web filter has been enabled, the administrator has the ability to
review the web filter logs via the web interface. The web filter logs
contain the URL that has been denied by the filter. Because of the fact that
unwanted characters are not stripped from the denied URL, a remote attacker
is able to gain the credentials of an administrator, as soon as the
administrator reviews the logs.

An example:
Pages with the keyword "mp3-download" are denied by the web filter. The page
<http://192.168.5.11/maarten.html> contains such a keyword. A remote
attacker could poison the log files by retrieving ''
http://192.168.5.11/maarten.html<script>alert(oops)</script>

When altering the script a bit, the user credentials could easily be
forwarded to the attacker, who could then use these credentials to alter the
firewall if the administrator has not properly secured access to
HTTPS/SSH/TELNET/HTTP.

Solution:
1. A basic rule in firewall administration is to only allow connections to
the firewall-administration-options from specific IP addresses (or
preferably, specific IP addresses connecting from a management network to
the management interface of the firewall). When this best practise is
applyed, an attacker that manages to gain administration credentials as
described above, will not be able to abuse them too easily.
2. Manage your firewall from a dedicated workstation that has no connections
(directly OR through a proxy) to untrusted networks in order to avoid a
credential push as described above.
3. Upgrade FortiOS 2.50MR4, which (according to fortinet) does not contain
this problem.

The first two solutions will also prevent abusal by the issues that have not
yet been disclosed.
Login or Register to add favorites

File Archive:

September 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    20 Files
  • 2
    Sep 2nd
    15 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    4 Files
  • 5
    Sep 5th
    1 Files
  • 6
    Sep 6th
    1 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    27 Files
  • 9
    Sep 9th
    7 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    9 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    25 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    15 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    12 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close