Fortinet FortiOS ve FortiSwitchManager'da Heap Tabanlı Arabellek Taşması Açığı

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

Üreticinin çözüm notu (İngilizce)

Upgrade to FortiSwitchManager version 7.2.7 or above
Upgrade to FortiSwitchManager version 7.0.6 or above
Fortinet remediated this issue in FortiSASE version 25.2.c and hence customers do not need to perform any action.
Fortinet remediated this issue in FortiSASE version 25.1.b and hence customers do not need to perform any action.
Upgrade to upcoming FortiOS version 8.0.0 or above
Upgrade to FortiOS version 7.6.4 or above
Upgrade to FortiOS version 7.4.9 or above
Upgrade to FortiOS version 7.2.12 or above
Upgrade to FortiOS version 7.0.18 or above

CISA'nın önerdiği eylem (İngilizce)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.