{"id":3235,"date":"2022-12-15T15:46:26","date_gmt":"2022-12-15T20:46:26","guid":{"rendered":"https:\/\/cert.pa\/?p=3235"},"modified":"2022-12-15T15:46:26","modified_gmt":"2022-12-15T20:46:26","slug":"csirt-panama-aviso-2022-12-15-vulnerabilidad-en-fortios-heap-based-buffer-overflow-en-sslvpnd","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=3235","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2022-12-15 Vulnerabilidad en FortiOS – heap-based buffer overflow en sslvpnd"},"content":{"rendered":"\n

CSIRT Panam\u00e1 Aviso 2022-12-15 Vulnerabilidad en FortiOS – heap-based buffer overflow en sslvpnd<\/strong><\/p>\n\n\n\n

Gravedad: Alta
Fecha de publicaci\u00f3n: diciembre 14, 2022
\u00daltima revisi\u00f3n: diciembre 14, 2022
Sitio web: https:\/\/www.fortiguard.com\/
Sistemas Afectados:<\/strong><\/p>\n\n\n\n

FortiOS versi\u00f3n 7.2.0 a 7.2.2
FortiOS versi\u00f3n 7.0.0 a 7.0.8
FortiOS versi\u00f3n 6.4.0 a 6.4.10
FortiOS versi\u00f3n 6.2.0 a 6.2.11
FortiOS versi\u00f3n 6.0.0 a 6.0.15
FortiOS versi\u00f3n 5.6.0 a
5.6.14 FortiOS versi\u00f3n 5.4.0 a 5.4.13
FortiOS versi\u00f3n 5.2.0 a 5.2.15
FortiOS versi\u00f3n 5.0.0 a 5.0.14
FortiOS-6K7K versi\u00f3n 7.0.0 a 7.0.7
FortiOS-6K7K versi\u00f3n 6.4.0 a 6.4.9
FortiOS-6K7K versi\u00f3n 6.2.0 a 6.2.11
FortiOS-6K7K versi\u00f3n 6.0.0 a 6.0.14<\/p>\n\n\n\n

  1. Descripci\u00f3n<\/strong><\/li><\/ol>\n\n\n\n

    Una vulnerabilidad de heap-based buffer overflow<\/strong> en FortiOS SSL-VPN puede permitir que un atacante remoto no autenticado ejecute c\u00f3digo o comandos arbitrarios a trav\u00e9s de solicitudes dise\u00f1adas espec\u00edficamente.<\/p>\n\n\n\n

    Fortinet tiene conocimiento de una instancia en la que se explot\u00f3 esta vulnerabilidad y recomienda validar inmediatamente sus sistemas contra los siguientes indicadores de compromiso:<\/p>\n\n\n\n

    M\u00faltiples entradas de registro con:<\/p>\n\n\n\n

    Logdesc=”Application crashed” and msg=”[…] application:sslvpnd,[…], Signal 11 received, Backtrace: […]\u201c<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    Presencia de los siguientes artefactos en el sistema de archivos:<\/p>\n\n\n\n

    \/data\/lib\/libips.bak<\/code>
    \/data\/lib\/libgif.so<\/code>
    \/data\/lib\/libiptcp.so<\/code>
    \/data\/lib\/libipudp.so<\/code>
    \/data\/lib\/libjepg.so<\/code>
    \/var\/.sslvpnconfigbk<\/code>
    \/data\/etc\/wxd.conf<\/code>
    \/flash<\/code><\/p>\n\n\n\n

    Conexiones a direcciones IP sospechosas desde FortiGate:<\/p>\n\n\n\n

    188.34.130.40:444<\/code>
    103.131.189.143:30080,30081,30443,20443<\/code>
    192.36.119.61:8443,444<\/code>
    172.247.168.153:8033<\/code>2 <\/p>\n\n\n\n

    2. Referencia a soluciones, herramientas e informaci\u00f3n<\/strong><\/p>\n\n\n\n

    Actualice a Fortigate versi\u00f3n 7.2.3, 7.0.9, 6.4.11 o 6.2.12 o posterior.<\/p>\n\n\n\n

    Fuentes:<\/strong><\/p>\n\n\n\n

    https:\/\/www.fortiguard.com\/psirt\/FG-IR-22-398<\/a><\/p>\n\n\n\n

    Informaci\u00f3n de contacto<\/strong>
    CSIRT PANAMA
    Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental
    E-Mail: info@cert.pa
    Phone: +507 520-2378
    Web: https:\/\/cert.pa
    Twitter: @CSIRTPanama
    Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"

    CSIRT Panam\u00e1 Aviso 2022-12-15 Vulnerabilidad en FortiOS – heap-based buffer overflow en sslvpnd Gravedad: AltaFecha de publicaci\u00f3n: diciembre 14, 2022\u00daltima revisi\u00f3n: diciembre 14, 2022Sitio web: https:\/\/www.fortiguard.com\/Sistemas Afectados: FortiOS versi\u00f3n 7.2.0 a 7.2.2FortiOS versi\u00f3n 7.0.0 a…<\/p>\n","protected":false},"author":4,"featured_media":1020,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-3235","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3235"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3235\/revisions"}],"predecessor-version":[{"id":3236,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3235\/revisions\/3236"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/1020"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}