Use-after-free in FortiProxy and FortiOS - CVE-2023-41675
Published: October 11, 2023
Vulnerability identifier: #VU81928
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-41675
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error within the Web proxy process. A remote non-authenticated attacker can send multiple specially crafted packets to the device and perform a denial of service (DoS) attack.
Successful exploitation of the vulnerability requires that SSL deep packet inspection is enabled.
Affected software
FortiProxy
RUGGEDCOM APE1808
FortiOS
RUGGEDCOM APE1808
FortiOS
How to mitigate CVE-2023-41675
Install updates from vendor's website.
FortiProxy - addressed in versions 7.0.9, 7.2.3
FortiOS - addressed in versions 7.0.11, 7.2.5
FortiOS - addressed in versions 7.0.11, 7.2.5