How to Fix CVE-2022-42475- A Critical Buffer Overflow Vulnerability in FortiOS SSL-VPN

Fortinet issued a warning bell about the exploitation of a critical buffer overflow vulnerability in FortiOS SSL-VPN. The flaw has been tracked with an identifier CVE-2022-42475 and has got a score of 9.3 out of 10 on the CVSS scale. as per the advisory, the vulnerability allows an unauthenticated, remote attacker to execute arbitrary code or commands on devices running vulnerable versions of ForitOS via specifically crafted requests.  Since Fortinet found instances of exploitation of this flaw in the wild, it is highly important to know how to fix CVE-2022-42475, a critical buffer overflow vulnerability in FortiOS SSL-VPN.

A Short Note About FortiOS:

FortiOS is a network security operating system developed by Fortinet, Inc. It provides a comprehensive set of networking and security features for organizations across all industries. With its unified architecture approach, FortiOS can be deployed on a wide range of Fortinet products including the FortiGate next-generation firewalls, the FortiWiFi wireless access points, and the FortiCloud cloud security solution. It can also be deployed on virtual machines and various other platforms such as Amazon Web Services (AWS) or Microsoft Azure.

The FortiOS operating system is designed to provide organizations with the flexibility and scalability they need to protect their networks in any environment. Fortinet also offers additional products such as the FortiManager appliance, which provides centralized management capabilities for large-scale deployments. These products work together with FortiOS to provide comprehensive network security solutions for organizations of all sizes.

Among its capabilities are firewall protection, intrusion prevention, application control, content filtering, secure web gateway, and more. It also offers advanced features such as deep packet inspection (DPI), threat intelligence, and zero-trust security. With its multi-layered defense architecture and robust feature set, FortiOS is a powerful solution for any organization seeking to protect its network infrastructure.

Summary of  CVE-2022-42475:

This is a heap-based buffer overflow vulnerability in FortiOS SSL-VPN. It allows an unauthenticated, remote attack to execute arbitrary code or commands on devices running vulnerable versions of ForitOS. This vulnerability is rated Critical and assigned a CVSS score of 9.3 out of 10. Attackers could exploit this vulnerability just by sending a specially crafted HTTP(S) request. According to the vendor, more details about the flaw is undisclosed due to security reasons.

FortiOS Versions Affected by CVE-2022-42475

There are multiple versions of ForitOS affected by this heap-based buffer overflow vulnerability in FortiOS SSL-VPN.

How to Fix CVE-2022-42475- A Critical Buffer Overflow Vulnerability in FortiOS SSL-VPN?

Fortinet acknowledged the vulnerability by releasing the emergency patch on Dec 12th. All the users of the vulnerable version of FrotiOS are advised to upgrade their appliances running FortiOS versions 7.2.3, 7.0.9, 6.4.11, and 6.2.12 and FortiOS-6K7K versions 7.0.8, 6.4.10, 6.2.12, and 6.0.15.

We recommend that users who can’t go for an upgrade immediately make the web console inaccessible from the public network and cover the admin console behind a VPN Firewall to access it from a remote place. In addition to this, Fortinet recommends users immediately validate their systems against the following indicators of compromise:

IOCs:

Multiple log entries with:

Logdesc=”Application crashed” and msg=”[…] application:sslvpnd,[…], Signal 11 received, Backtrace: […]“

Presence of the following artifacts in the filesystem:

Connections to suspicious IP addresses from the FortiGate:

How to Upgrade FortiOS?

If you want to go for the manual upgrade process, download the upgrade image from https://support.fortinet.com, go to the ‘File Upload’ tab and upload the image. For the recommended upgrade path, see Upgrade Path Tool.

We hope this post helps you know  how to fix CVE-2022-42475, a critical buffer overflow vulnerability in FortiOS SSL-VPN. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium & Instagram, and subscribe to receive updates like this.