Helpful ReplyHot!Fortinet PSIRT Advisory FG-IR-18-100

Author
snobs
Silver Member
  • Total Posts : 74
  • Scores: 4
  • Reward points: 0
  • Joined: 2011/02/19 22:41:39
  • Status: offline
2019/11/26 04:01:00 (permalink) 6.0
0

Fortinet PSIRT Advisory FG-IR-18-100

Hello Fortinet users,
 
have you read https://fortiguard.com/psirt/FG-IR-18-100 and https://seclists.org/bugtraq/2019/Nov/38 already?
 
The author of the vulnerability suggests that all information of traffic that is analyzed by "FortiGuard AntiVirus", "FortiGuard AntiSpam" and "FortiGuard Web Filter" is being transfered to Fortinet´s server => really?
 
There is no limitation mentioned on the homepage of the author, i.e. "FortiCloud logging enabled".

We currently use:
- Fortigate Firewalls with FortiOS 6.0.7
- Web Rating Overrides
- SSL inspection is enabled
- Antivirus-Monitoring WITHOUT "FortiSandbox Cloud for Inspection"
- Anti-Spam WITHOUT "Spam Submission" option

We don´t use:
- FortiCloud for logging

So I´m ask myself if we were ever affected by this issue at all? Does someone knows more?
#1
tanr
Platinum Member
  • Total Posts : 696
  • Scores: 31
  • Reward points: 0
  • Joined: 2016/05/09 17:09:43
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/11/26 14:55:51 (permalink)
0
The PSIRT says 6.0.7 is still vulnerable, but the seclist says 6.0.7 is one of the "Solution" versions.
 
Anybody have a direct answer on this from Fortinet?
#2
alex_buric
Bronze Member
  • Total Posts : 22
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/04/26 23:23:53
  • Location: Elizabeth, NJ
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/11/26 22:47:53 (permalink)
0

Solutions

Upgrade to FortiOS 6.2.0
Upgrade to FortiClientWindows 6.2.0
Upgrade to FortiClientMac 6.2.2
#3
tanr
Platinum Member
  • Total Posts : 696
  • Scores: 31
  • Reward points: 0
  • Joined: 2016/05/09 17:09:43
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/11/27 07:24:09 (permalink)
0
Yes, that's from the PSIRT, and in the seclist entry it says:
 
Solution:
---------
The vendor provides updated versions for the affected products:
* FortiOS 6.0.7 or 6.2.0
* FortiClientWindows 6.2.0
* FortiClientMac 6.2.2
 
Note that 6.2.x is not a solution for most.  I don't consider it stable enough to use in production yet.
post edited by tanr - 2019/11/27 07:25:10
#4
tanr
Platinum Member
  • Total Posts : 696
  • Scores: 31
  • Reward points: 0
  • Joined: 2016/05/09 17:09:43
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/11/27 11:17:34 (permalink)
5 (1)
Per bug 491701 there is no 6.0.x solution for this yet.

I’ll be opening a case on this with TAC ASAP. This needs a solution for 6.0 and 5.6.
#5
st3fan
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/01/20 06:29:04
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/11/28 05:47:44 (permalink)
0
Feedback I received from Support:
"All FOS below 6.2.0 INCLUDING fos 6.0.7 are still affected with this vulnerability and the only available solution to mitigate this vulnerability for now would be to upgrade to FOS 6.2.0 onward. However, we have requested backport fix to have it included in FOS 6.0 but it is still under discussion with Engineering team."
#6
poundy
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/06/13 20:58:45
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/11/28 18:19:33 (permalink)
0
Well given the 6.2 state of play (doesn't seem ready to go live to me) I think it's imperative that Forti engineering release a down-level update for 6.0.x stream.
#7
boneyard
Gold Member
  • Total Posts : 183
  • Scores: 8
  • Reward points: 0
  • Joined: 2014/07/30 11:15:18
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/11/29 00:35:23 (permalink) ☄ Helpfulby poundy 2019/11/29 01:45:53
0
and kinda weird that the responsible disclosure seemed to have "waited" for the fix in 6.0.7 which then doesn't be the case, communication didnt go optimal here unfortunately.
 
hoping on that 6.0.x fix to make everyone at ease. the issue doesnt feel that bad, but you want it solved.
#8
poundy
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/06/13 20:58:45
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/11/29 01:46:38 (permalink)
0
agreed on impact assessment - not the kind of thing you want to have a security product doing but not a critical-to-update issue
#9
st3fan
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/01/20 06:29:04
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/12/06 03:28:04 (permalink)
0
FYI, received the below from Support today.
"The fix is planned to be included in FOS 6.0.8 (expected release date: any time this week/ beginning of next week) and FOS 5.6.12 which will be expected to be released end of next week."
#10
boneyard
Gold Member
  • Total Posts : 183
  • Scores: 8
  • Reward points: 0
  • Joined: 2014/07/30 11:15:18
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/12/07 02:48:43 (permalink)
0
thanks for sharing, feels like they release 6.0.8 quite quickly just for this.
#11
sw2090
Platinum Member
  • Total Posts : 484
  • Scores: 23
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/12/09 00:00:40 (permalink)
0
I found 6.0.8 this morning at the support portal. Thus there is still no upgrade path available in the upgrade path tool.
I've upgrade some FGT thid moni from 6.0.7 to 6.0.8 (or 5.6.11 to 6.0.8) without any problems.
#12
boneyard
Gold Member
  • Total Posts : 183
  • Scores: 8
  • Reward points: 0
  • Joined: 2014/07/30 11:15:18
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/12/09 00:58:34 (permalink)
0
yeah, it is nice they released it quickly, but at that point you see they have not caught up with all things involved.
 
i would assume that it is almost like 6.0.7.1 as it just fixes one thing, so probably the upgrade path is 6.0.5 --> 6.0.8, but still write this down Fortinet.
 
similar question with FortiManager / FortiAnalyzer, does version 6.0.7 of those support 6.0.8 without issues?
#13
tanr
Platinum Member
  • Total Posts : 696
  • Scores: 31
  • Reward points: 0
  • Joined: 2016/05/09 17:09:43
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/12/09 07:33:04 (permalink)
0
Note that per the docs (but not the release notes!) the upgrade doesn't automatically fix the issue. 
To do that you need to:
 
config sys fortiguard
    set protocol https
end
 
I'm assuming this works over any of the port options but haven't tested it.
#14
boneyard
Gold Member
  • Total Posts : 183
  • Scores: 8
  • Reward points: 0
  • Joined: 2014/07/30 11:15:18
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/12/09 08:44:02 (permalink)
0
ticket at Fortinet support first said 6.0.5 --> 6.0.8 would be possible, but then came back that 6.0.5 --> 6.0.7 --> 6.0.8 would be better / more safe, so it will be an extra step for me.
 
FortiManager / FortiAnalyzer 6.0.7 will work fine with 6.0.8.
 
port seems limited to 8888 and 53
 
fg-grtpr (fortiguard) # set port
8888    port 8888 for server communication.
53      port 53 for server communication.


as for that piece of configuration (set protocol https) it makes me wonder about 6.2.x, if you have protocol set there to something else then https (checked some and they are set to UDP), is it safe or not?
 
if your FortiGate is behind another firewall then you might have to change things on that other firewall allowing tcp/8888 probably.
post edited by boneyard - 2019/12/09 11:18:52
#15
tanr
Platinum Member
  • Total Posts : 696
  • Scores: 31
  • Reward points: 0
  • Joined: 2016/05/09 17:09:43
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/12/09 11:58:57 (permalink)
0
Third hand response from TAC is that protcol https is the only secure method.  Didn't talk to them directly though.
#16
TecnetRuss
New Member
  • Total Posts : 12
  • Scores: 4
  • Reward points: 0
  • Joined: 2017/02/27 13:14:44
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/12/09 22:52:53 (permalink) ☄ Helpfulby tanr 2019/12/10 07:31:19
0
It looks like the 6.2.x GUI option under System / FortiGuard called "FortiGuard Filtering Protocol" has been back-ported to 6.0.8+.  As Tanr noted and mentioned in the Upgrade Information of the release notes, you do have to set this manually (either by command line or in the GUI) to take advantage of secure FortiGuard communication if you are upgrading a config to 6.0.8.  If you are starting with a fresh/new or factory-reset 6.0.8+ build, HTTPS is the new default instead of UDP.
 
Source: https://docs.fortinet.com/document/fortigate/6.0.8/fortios-release-notes/901852/fortiguard-protocol-and-port-number
 
Russ
#17
sw2090
Platinum Member
  • Total Posts : 484
  • Scores: 23
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/12/09 23:37:25 (permalink)
0
As I saw per this morning the upgrade paths for 6.0.8 are now available...
#18
tanr
Platinum Member
  • Total Posts : 696
  • Scores: 31
  • Reward points: 0
  • Joined: 2016/05/09 17:09:43
  • Status: offline
Re: Fortinet PSIRT Advisory FG-IR-18-100 2019/12/10 07:31:23 (permalink)
0
@TecnetRuss, thanks for the link.  Looks like they updated the docs since I read them.
#19
Jump to:
© 2019 APG vNext Commercial Version 5.5