The insurance market has detected “unusual activity” and turned off its systems

Read More

CEOs put cybersecurity seventh behind near-term risks such as the economy and potential recession

Read More

Fortinet has patched a critical authentication bypass in its FortiOS and FortiProxy products that could lead to administrator access.

Background

On October 7, public reports began to circulate that Fortinet communicated directly with customers about a critical vulnerability in its FortiOS and FortiProxy products. This vulnerability, CVE-2022-40684, has been patched, but Fortinet has not released a full advisory yet via its Product Security Incident Response Team. 

Fortinet usually follows a monthly release schedule for security advisories on the second Tuesday of every month, the same day as Microsoft’s Patch Tuesday. It remains to be seen whether it will follow the same schedule for the CVE-2022-40684 advisory. The following tweet contains an image taken from the email communication sent to Fortinet customers.

Update: By now the full text of the e-mail and a screenshot of the internal advisory have been shared.
So here goes a screenshot of the unredacted full e-mail as shared on Facebook. Also containing possible #workarounds.#Fortinet #CVE202240684 #RCE #authbypass #advisory pic.twitter.com/ruVmYhyXA5

— Gitworm (@Gi7w0rm) October 7, 2022

Analysis

CVE-2022-40684 is a critical authentication bypass vulnerability that received a CVSSv3 score of 9.6. By sending specially crafted HTTP or HTTPS requests to a vulnerable target, a remote attacker with access to the management interface could perform administrator operations.

At this time, there is no information on whether this vulnerability has been exploited in attacks. But, given threat actors’ penchant for targeting FortiOS vulnerabilities, Fortinet’s recommendation to remediate this vulnerability “with the utmost urgency” is appropriate.

Solution

The communications Fortinet sent to customers that have now been shared publicly on Twitter, outline the following vulnerable and fixed version numbers:

If you cannot apply patches immediately, Fortinet states that using a local-in-policy to limit access to the management interface. Fortinet also includes steps on disabling administrative access to the internet facing interface and steps on restricting access to trusted hosts in their FortiGate Hardening Guide. As the guide notes, these steps are part of their system administrator best practices.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released. Customers can also use Plugin ID 73522 to identify the version of Fortinet Devices in your network. Please note that the plugin does require providing SSH credentials for the Fortinet device.

Get more information

FortiOS release notes for 7.2.2
FortiOS release notes for 7.0.7
Fortinet PSIRT

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.

Read More

Cryptojacking is turning into a security nightmare for consumers and enterprises alike. Malicious actors have used a variety of techniques to install cryptojackers on victims’ computers and in a new development, cybersecurity software maker Bitdefender has detected a cryptojacking campaign that uses a Microsoft OneDrive vulnerability to gain persistence and run undetected on infected devices.

Between May 1 and July 1, Bitdefender detected about 700 users who were affected by the campaign. The campaign uses four cryptocurrency mining algorithms—Ethash, Etchash, Ton and XMR— making an average of $13 worth of cryptocurrency per infected computer, Bitdefender reported this week.

To read this article in full, please click here

Read More