CVE-2018-13381: Buffer Overflow

Q: What is CVE-2018-13381?

CVE-2018-13381 is a buffer overflow vulnerability in Fortinet FortiOS and FortiProxy that allows a non-authenticated attacker to perform a Denial-of-Service attack.

Q: Which versions of Fortinet FortiOS are affected by CVE-2018-13381?

Fortinet FortiOS versions 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, and 5.4 and earlier versions are affected by CVE-2018-13381.

Q: Which version of Fortinet FortiProxy is affected by CVE-2018-13381?

Fortinet FortiProxy version 2.0.0 and 1.2.8 are affected by CVE-2018-13381.

Q: What is the severity of CVE-2018-13381?

CVE-2018-13381 has a severity rating of 7.5 (high).

Q: How can I mitigate the vulnerability CVE-2018-13381?

To mitigate the vulnerability CVE-2018-13381, it is recommended to update to the latest patched version of Fortinet FortiOS and FortiProxy.

Published Jun 4, 2019

Updated

A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0, 1.2.8 and earlier versions under SSL VPN web portal allows a non-authenticated attacker to perform a Denial-of-service attack via special craft message payloads.

Affected Software

6 affected components

Fortinet FortiProxy<=1.2.8

Fortinet FortiProxy=2.0.0

Fortinet FortiOS<=5.2.14

Fortinet FortiOS>=5.4.0<=5.4.12

Fortinet FortiOS>=5.6.0<=5.6.10

Fortinet FortiOS>=6.0.0<=6.0.4

Event History

Jun 4, 2019

CVE Published

via MITRE·08:26 PM

Data Sourced

via MITRE·08:26 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2018-13381?

CVE-2018-13381 is a buffer overflow vulnerability in Fortinet FortiOS and FortiProxy that allows a non-authenticated attacker to perform a Denial-of-Service attack.

Which versions of Fortinet FortiOS are affected by CVE-2018-13381?

Fortinet FortiOS versions 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, and 5.4 and earlier versions are affected by CVE-2018-13381.

Which version of Fortinet FortiProxy is affected by CVE-2018-13381?