UCloud-202306-001:Fortinet FortiOS SSL-VPN 远程代码执行漏洞通告

漏洞简述

该漏洞存在于Fortinet FortiOS SSL-VPN中，是一个远程代码执行漏洞。Fortinet FortiOS SSL-VPN中存在一个基于堆的缓冲区溢出错误，未经身份验证的远程攻击者可利用该漏洞，通过特制请求使设备远程崩溃并执行任意代码。

影响版本

Fortinet:FortiOS SSL-VPN 6.0.x < 6.0.17

Fortinet:FortiOS SSL-VPN 6.2.x < 6.2.15

Fortinet:FortiOS SSL-VPN 6.4.x < 6.4.13

Fortinet:FortiOS SSL-VPN 7.0.x < 7.0.12

Fortinet:FortiOS SSL-VPN 7.2.x < 7.2.5

安全版本

Fortinet:FortiOS SSL-VPN 6.0.x >= 6.0.17

Fortinet:FortiOS SSL-VPN 6.2.x >= 6.2.15

Fortinet:FortiOS SSL-VPN 6.4.x >= 6.4.13

Fortinet:FortiOS SSL-VPN 7.0.x >= 7.0.12

Fortinet:FortiOS SSL-VPN 7.2.x >= 7.2.5

参考链接

1、https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/9b64158a-f34b-11ed-8e6d-fa163e15d75b/fortios-v6.0.17-release-notes.pdf

2、https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/c46146c1-f10b-11ed-8e6d-fa163e15d75b/fortios-v6.2.15-release-notes.pdf

3、https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/a2c8550a-fe3d-11ed-8e6d-fa163e15d75b/fortios-v6.4.13-release-notes.pdf

4、https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/c7676a14-fe3d-11ed-8e6d-fa163e15d75b/fortios-v7.0.12-release-notes.pdf

5、https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/e52fe5af-fe3d-11ed-8e6d-fa163e15d75b/fortios-v7.2.5-release-notes.pdf