SB2019072802 - Multiple vulnerabilities in FortiGate FortiOS

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Authorization (CVE-ID: CVE-2019-5591)

The vulnerability allows a remote attacker to impersonate LDAP server.

The vulnerability exists due to FortiOS does not check LDAP server identity by default. A remote attacker with ability to perform MitM attack can impersonate LDAP server and gain unauthorized access to network resources.

2) Information disclosure (CVE-ID: CVE-2018-13367)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to FortiOS WEB UI reveals version and other system information via JS files. A remote non-authenticated attacker can gain access to potentially sensitive information.

Remediation

Install update from vendor's website.

References

• https://fortiguard.com/psirt/FG-IR-19-037
• https://fortiguard.com/psirt/